# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [rclone \`serve restic --private-repos\` authorization bypass: \`..\` in the URL path lets an authenticated user read, overwrite and delete other users' repositories](https://agentprime.io/advisories/GHSA-fqj9-69pf-6pjg.md)
  `GHSA-fqj9-69pf-6pjg`, `BIT-rclone-2026-59733`, `CVE-2026-59733`, `GO-2026-6195` · Go `github.com/rclone/rclone`: affected `<1.74.4`, fixed in `1.74.4` · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal, Broken access control
- [rclone: Path traversal in serve s3 allows reading and overwriting root-level files](https://agentprime.io/advisories/GHSA-8v25-v8p6-qf7v.md)
  `GHSA-8v25-v8p6-qf7v`, `BIT-rclone-2026-79781`, `CVE-2026-79781`, `GO-2026-6189` · Go `github.com/rclone/rclone`: affected `<1.74.4`, fixed in `1.74.4` · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal](https://agentprime.io/advisories/CVE-2026-18959.md)
  `CVE-2026-18959` · CVE record: yushine InnoShop · CVSS 5.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [rclone: Unvalidated symlink target in local \`--links\` — arbitrary file write from an untrusted remote](https://agentprime.io/advisories/GHSA-cf44-9pgv-m4xc.md)
  `GHSA-cf44-9pgv-m4xc`, `BIT-rclone-2026-54572`, `CVE-2026-54572`, `GO-2026-6191` · Go `github.com/rclone/rclone`: affected `<1.74.4`, fixed in `1.74.4` · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [rclone: Incomplete path validation allows backend root escape in serve restic](https://agentprime.io/advisories/GHSA-45pq-889g-fcgh.md)
  `GHSA-45pq-889g-fcgh`, `BIT-rclone-2026-71309`, `CVE-2026-71309`, `GO-2026-6184` · Go `github.com/rclone/rclone`: affected `>=1.40.0, <1.75.0`, fixed in `1.75.0` · CVSS 8.6 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header](https://agentprime.io/advisories/CVE-2026-17556.md)
  `CVE-2026-17556` · CVE record: GitHub Enterprise Server · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download](https://agentprime.io/advisories/GHSA-r4h8-2xpq-v48g.md)
  `GHSA-r4h8-2xpq-v48g`, `CVE-2026-66881`, `EEF-CVE-2026-66881` · Hex `livebook`: affected `>=0.11.0, <0.18.7 || >=0.19.0, <0.19.9`, fixed in `0.18.7`, `0.19.9` · CVSS 7.0 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server](https://agentprime.io/advisories/CVE-2026-18953.md)
  `CVE-2026-18953` · CVE record: AWS aws-transform-mcp-server · CVSS 6.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement](https://agentprime.io/advisories/CVE-2026-8183.md)
  `CVE-2026-8183` · CVE record: IBM Langflow OSS · CVSS 7.7 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement](https://agentprime.io/advisories/CVE-2026-7658.md)
  `CVE-2026-7658` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement](https://agentprime.io/advisories/CVE-2026-7869.md)
  `CVE-2026-7869` · CVE record: IBM Langflow OSS · CVSS 5.4 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Path traversal in Jenkins](https://agentprime.io/advisories/CVE-2026-70428.md)
  `CVE-2026-70428` · CVE record: Jenkins Project Jenkins · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Symlink following in Jenkins](https://agentprime.io/advisories/CVE-2026-70427.md)
  `CVE-2026-70427` · CVE record: Jenkins Project Jenkins · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access](https://agentprime.io/advisories/CVE-2026-20310.md)
  `CVE-2026-20310` · CVE record: Cisco Cisco Catalyst SD-WAN Controller and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Langflow is affected by security vulnerabilities in Model Context Protocol features](https://agentprime.io/advisories/CVE-2026-7646.md)
  `CVE-2026-7646` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Cross-site scripting in Progress MarkLogic Server Query Console](https://agentprime.io/advisories/CVE-2026-9195.md)
  `CVE-2026-9195` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal, Cross-site scripting (XSS)
- [CCleaner local privilege escalation via link following on uninstall](https://agentprime.io/advisories/CVE-2026-12410.md)
  `CVE-2026-12410` · CVE record: Gen Digital CCleaner · CVSS 7.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion](https://agentprime.io/advisories/CVE-2026-15979.md)
  `CVE-2026-15979` · CVE record: keywordrush Content Egg – Affiliate Product Importer & Price Comparison · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Fledge IoT Gateway Backup Restore Tar Path Traversal](https://agentprime.io/advisories/CVE-2026-71283.md)
  `CVE-2026-71283` · CVE record: fledge-iot fledge · CVSS 4.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-71279.md)
  `CVE-2026-71279` · CVE record: Koenkk zigbee2mqtt · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-71268.md)
  `CVE-2026-71268` · CVE record: thiagoralves OpenPLC_v3 · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Path traversal in Eclipse Foundation Eclipse Mojarra](https://agentprime.io/advisories/CVE-2026-46581.md)
  `CVE-2026-46581` · CVE record: Eclipse Foundation Eclipse Mojarra · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal, Code injection, CWE-641
- [Path traversal in Eclipse Foundation Eclipse Theia](https://agentprime.io/advisories/CVE-2026-61891.md)
  `CVE-2026-61891` · CVE record: Eclipse Foundation Eclipse Theia · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal, Information disclosure, Authentication bypass
- [Cross-site request forgery in Eclipse Foundation Eclipse Theia](https://agentprime.io/advisories/CVE-2026-60009.md)
  `CVE-2026-60009` · CVE record: Eclipse Foundation Eclipse Theia · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal, Authentication bypass, Cross-site request forgery (CSRF)
- [Path traversal in Eclipse Foundation Eclipse Theia](https://agentprime.io/advisories/CVE-2026-12609.md)
  `CVE-2026-12609` · CVE record: Eclipse Foundation Eclipse Theia · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [art-template - Path Traversal in Sub-Template Resolution via include()/extend()](https://agentprime.io/advisories/CVE-2026-71215.md)
  `CVE-2026-71215` · CVE record: art-template art-template · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal](https://agentprime.io/advisories/CVE-2026-71209.md)
  `CVE-2026-71209` · CVE record: advplyr audiobookshelf · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools](https://agentprime.io/advisories/CVE-2026-55747.md)
  `CVE-2026-55747` · CVE record: The-Pocket PocketFlow (pocketflow-coding-agent cookbook example) · CVSS 6.8 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal](https://agentprime.io/advisories/CVE-2026-16940.md)
  `CVE-2026-16940` · CVE record: Unknown Custom Fields · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [yeqifu warehouse FileController.java path traversal](https://agentprime.io/advisories/CVE-2026-18903.md)
  `CVE-2026-18903` · CVE record: yeqifu warehouse · CVSS 5.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [PathTravelsal Vulnerability in com.talpa.hibrowser](https://agentprime.io/advisories/CVE-2026-18907.md)
  `CVE-2026-18907` · CVE record: TECNO Mobile Hi Browser · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversal](https://agentprime.io/advisories/CVE-2026-18853.md)
  `CVE-2026-18853` · CVE record: ZomboDroid Meme Generator App · CVSS 4.8 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Ghost: Theme Upload Path Traversal](https://agentprime.io/advisories/GHSA-cjc9-q5gf-327p.md)
  `GHSA-cjc9-q5gf-327p`, `BIT-ghost-2026-70593`, `CVE-2026-70593` · npm `ghost`: affected `>=0.10.0, <6.54.1`, fixed in `6.54.1` · CVSS 6.6 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Ghost: Database Backup Path Traversal](https://agentprime.io/advisories/GHSA-cj62-hvv2-2q5h.md)
  `GHSA-cj62-hvv2-2q5h`, `BIT-ghost-2026-70592`, `CVE-2026-70592` · npm `ghost`: affected `>=1.20.1, <6.54.1`, fixed in `6.54.1` · CVSS 5.5 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes](https://agentprime.io/advisories/CVE-2026-47682.md)
  `CVE-2026-47682` · CVE record: cvat-ai cvat · CVSS 7.1 High · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing](https://agentprime.io/advisories/GHSA-wvqv-fj8w-qmhm.md)
  `GHSA-wvqv-fj8w-qmhm`, `BIT-django-2026-15307`, `CVE-2026-15307`, `PYSEC-2026-4035` · PyPI `django`: affected `<5.2.17 || >=6.0a1, <6.0.8`, fixed in `5.2.17`, `6.0.8` · CVSS 8.7 High · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [Flowise: Authenticated arbitrary file write in the \`S3 Directory\` document loader via unsanitized S3 object keys](https://agentprime.io/advisories/GHSA-88pr-878c-24wf.md)
  `GHSA-88pr-878c-24wf` · npm `flowise` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 4.0, no score published · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Path traversal in NVIDIA Dynamo](https://agentprime.io/advisories/CVE-2026-47612.md)
  `CVE-2026-47612` · CVE record: NVIDIA Dynamo · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Path traversal in NVIDIA Triton Inference Server](https://agentprime.io/advisories/CVE-2026-47487.md)
  `CVE-2026-47487` · CVE record: NVIDIA Triton Inference Server · CVSS 4.4 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Path traversal in Veeam Service Provider Console](https://agentprime.io/advisories/CVE-2026-58072.md)
  `CVE-2026-58072` · CVE record: Veeam Service Provider Console · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music](https://agentprime.io/advisories/CVE-2026-69110.md)
  `CVE-2026-69110` · CVE record: Microck opencode-studio · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Perspective 5.0.0 Path Traversal via cwd_static_file_handler](https://agentprime.io/advisories/CVE-2026-67200.md)
  `CVE-2026-67200` · CVE record: perspective-dev perspective · CVSS 8.7 High · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer](https://agentprime.io/advisories/CVE-2026-18806.md)
  `CVE-2026-18806` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer · CVSS 7.1 High · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Path Traversal Allows Arbitrary File Download in Bilin Software's HUMANIST Digital Human Resources](https://agentprime.io/advisories/CVE-2026-14194.md)
  `CVE-2026-14194` · CVE record: Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources · CVSS 6.5 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Path traversal in Zyxel ATP series firmware and others](https://agentprime.io/advisories/CVE-2026-14818.md)
  `CVE-2026-14818` · CVE record: Zyxel ATP series firmware and 3 more · CVSS 7.2 High · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Wildfly-core: path traversal on wildfly domain controller](https://agentprime.io/advisories/CVE-2026-17614.md)
  `CVE-2026-17614` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1 and 3 more · CVSS 4.4 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Path traversal in Rocket.Chat](https://agentprime.io/advisories/CVE-2026-56845.md)
  `CVE-2026-56845` · CVE record: Rocket.Chat Rocket.Chat · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal
- [Microsoft Edge for Android Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-65802.md)
  `CVE-2026-65802` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 7.4 High · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal
- [Microsoft Edge for Android Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-66310.md)
  `CVE-2026-66310` · CVE record: Microsoft Microsoft Edge for Android · CVSS 7.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal
- [Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal](https://agentprime.io/advisories/CVE-2026-18648.md)
  `CVE-2026-18648` · CVE record: Blix Email Blue Mail Calendar App · CVSS 4.8 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal
- [danpros HTMLy Author Name htmly.php path traversal](https://agentprime.io/advisories/CVE-2026-18646.md)
  `CVE-2026-18646` · CVE record: danpros HTMLy · CVSS 6.9 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal
- [danpros HTMLy Admin Content Endpoint admin.php add_content path traversal](https://agentprime.io/advisories/CVE-2026-18645.md)
  `CVE-2026-18645` · CVE record: danpros HTMLy · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal
- [GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()](https://agentprime.io/advisories/GHSA-539m-9xh6-q6rr.md)
  `GHSA-539m-9xh6-q6rr`, `CVE-2026-73619`, `PYSEC-2026-3948` · PyPI `gitpython`: affected `<3.1.57`, fixed in `3.1.57` · CVSS 7.1 High · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal, Information disclosure
- [GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read](https://agentprime.io/advisories/GHSA-3f7w-8rr8-f37f.md)
  `GHSA-3f7w-8rr8-f37f`, `CVE-2026-73620`, `PYSEC-2026-3949` · PyPI `gitpython`: affected `<3.1.57`, fixed in `3.1.57` · CVSS 7.2 High · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal, Information disclosure
- [danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal](https://agentprime.io/advisories/CVE-2026-18644.md)
  `CVE-2026-18644` · CVE record: danpros HTMLy · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal
- [Symlink following in Dell Monitor driver](https://agentprime.io/advisories/CVE-2026-40717.md)
  `CVE-2026-40717` · CVE record: Dell Monitor driver · CVSS 6.6 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal
- [PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when \`from\` is unset](https://agentprime.io/advisories/GHSA-fxqj-rqcc-2cmp.md)
  `GHSA-fxqj-rqcc-2cmp`, `CVE-2026-69153` · npm `postcss`: affected `<8.5.23`, fixed in `8.5.23` · CVSS 6.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal, Information disclosure
- [Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions](https://agentprime.io/advisories/CVE-2026-61372.md)
  `CVE-2026-61372` · CVE record: Apache Software Foundation Apache Jena Fuseki · CVSS 7.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal
- [Duplicate Advisory: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure](https://agentprime.io/advisories/GHSA-x7jr-gvvr-p9w7.md)
  `GHSA-x7jr-gvvr-p9w7` · Go `github.com/siyuan-note/siyuan/kernel`: affected `*`, no fixed version yet · CVSS 7.7 High · Withdrawn · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal
- [Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images](https://agentprime.io/advisories/GHSA-mmwh-j75q-gxp8.md)
  `GHSA-mmwh-j75q-gxp8` · Packagist `getgrav/grav`: affected `=2.0.10`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 3 Aug 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA4LTAzVDE1OjMyOjQ4LjAwMDAwMFoiLCJHSFNBLW1td2gtajc1cS1neHA4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTA4LTA1VDIwOjQzOjQ3LjAwMDAwMFoiLCJHSFNBLTR2cjUtcDJnYy1oMjNwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTA4LTA1VDIwOjQzOjQ3LjAwMDAwMFoiLCJHSFNBLTR2cjUtcDJnYy1oMjNwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.