# Path traversal. File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Microsoft PowerShell Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-70337.md) `CVE-2026-70337` · CVE record: Microsoft PowerShell 7.4 and 2 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [.NET Framework Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-65810.md) `CVE-2026-65810` · CVE record: Microsoft Microsoft .NET Framework 3.5 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Windows User Profile Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62832.md) `CVE-2026-62832` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Windows DHCP Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62807.md) `CVE-2026-62807` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Windows DHCP Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62803.md) `CVE-2026-62803` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Windows DHCP Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62776.md) `CVE-2026-62776` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Windows DHCP Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62761.md) `CVE-2026-62761` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-61358.md) `CVE-2026-61358` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-72971.md) `CVE-2026-72971` · CVE record: Microsoft Windows 11 version 26H1 · CVSS 5.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Windows Management Services Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-70348.md) `CVE-2026-70348` · CVE record: Microsoft Windows 11 Version 24H2 and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Windows DHCP Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62812.md) `CVE-2026-62812` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Microsoft SharePoint Server Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-62837.md) `CVE-2026-62837` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Microsoft Teams Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-65768.md) `CVE-2026-65768` · CVE record: Microsoft Microsoft Teams for Android · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2026-48442.md) `CVE-2026-48442` · CVE record: Adobe Content Credentials Rust SDK and 2 more · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2026-48446.md) `CVE-2026-48446` · CVE record: Adobe Content Credentials Rust SDK and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Path traversal in gaudi-container-runtime](https://agentprime.io/advisories/CVE-2026-32677.md) `CVE-2026-32677` · CVE record: gaudi-container-runtime · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Zoom VDI - Path Traversal](https://agentprime.io/advisories/CVE-2026-53416.md) `CVE-2026-53416` · CVE record: Zoom Communications Zoom VDI · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials](https://agentprime.io/advisories/CVE-2026-73079.md) `CVE-2026-73079` · CVE record: Wei-Shaw sub2api · CVSS 8.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal, CWE-441 - [Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal](https://agentprime.io/advisories/GHSA-9w6w-8x3c-hfqp.md) `GHSA-9w6w-8x3c-hfqp` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1`, no fixed version yet · CVSS 6.2 Medium · Withdrawn · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Velociraptor directory traversal via the NewNotebook API](https://agentprime.io/advisories/CVE-2026-18640.md) `CVE-2026-18640` · CVE record: Rapid7 Velociraptor · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [External control of a file path in Ivanti Endpoint Manager](https://agentprime.io/advisories/CVE-2026-18127.md) `CVE-2026-18127` · CVE record: Ivanti Endpoint Manager · CVSS 7.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Path traversal in Siemens License Server (SLS)](https://agentprime.io/advisories/CVE-2026-69109.md) `CVE-2026-69109` · CVE record: Siemens Siemens License Server (SLS) · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Intelliants Subrion CMS - Path Traversal](https://agentprime.io/advisories/CVE-2026-72604.md) `CVE-2026-72604` · CVE record: Intelliants Subrion CMS · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [AsyncFuncAI deepwiki-open - Path Traversal](https://agentprime.io/advisories/CVE-2026-72602.md) `CVE-2026-72602` · CVE record: AsyncFuncAI deepwiki-open · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0](https://agentprime.io/advisories/CVE-2026-33922.md) `CVE-2026-33922` · CVE record: Nozomi Networks Arc · CVSS 6.8 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation](https://agentprime.io/advisories/CVE-2026-72694.md) `CVE-2026-72694` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Path Traversal](https://agentprime.io/advisories/CVE-2026-16053.md) `CVE-2026-16053` · CVE record: Zohocorp ManageEngine M365 Manager Plus and 1 more · CVSS 8.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Path Traversal: '.../...//' in Crafty Controller](https://agentprime.io/advisories/CVE-2026-13716.md) `CVE-2026-13716` · CVE record: Arcadia Technology, LLC Crafty Controller · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Multiple vulnerabilities in SAP Business AI Platform (Approuter)](https://agentprime.io/advisories/CVE-2026-66777.md) `CVE-2026-66777` · CVE record: SAP_SE SAP Business AI Platform (Approuter) · CVSS 5.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence](https://agentprime.io/advisories/CVE-2026-44763.md) `CVE-2026-44763` · CVE record: SAP_SE SAP Manufacturing Integration and Intelligence · CVSS 7.6 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices](https://agentprime.io/advisories/CVE-2025-30240.md) `CVE-2025-30240` · CVE record: TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6 and 4 more · CVSS 5.1 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Accelerate path traversal and denial of service via sharded checkpoint weight_map entries](https://agentprime.io/advisories/GHSA-4j2p-28q2-5m79.md) `GHSA-4j2p-28q2-5m79`, `CVE-2026-69112`, `PYSEC-2026-3804` · PyPI `accelerate`: affected `<=1.14.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Libvirt: swtpm privilege escalation via symlink following](https://agentprime.io/advisories/CVE-2026-63622.md) `CVE-2026-63622` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory](https://agentprime.io/advisories/CVE-2026-72903.md) `CVE-2026-72903` · CVE record: Eugeny tabby · CVSS 8.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php](https://agentprime.io/advisories/CVE-2026-73033.md) `CVE-2026-73033` · CVE record: Sucuri sucuri-wordpress-plugin · CVSS 7.0 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape](https://agentprime.io/advisories/CVE-2026-73030.md) `CVE-2026-73030` · CVE record: frostming unearth · CVSS 7.2 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload](https://agentprime.io/advisories/CVE-2026-71964.md) `CVE-2026-71964` · CVE record: usmannasir cyberpanel · CVSS 7.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Authenticated Arbitrary File Write Vulnerability in multiple devices](https://agentprime.io/advisories/CVE-2026-12339.md) `CVE-2026-12339` · CVE record: TP-Link Systems Inc. TL-MR6400 v5.3 and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()](https://agentprime.io/advisories/CVE-2026-70622.md) `CVE-2026-70622` · CVE record: composefs tar-rs · CVSS 7.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [unauthenticated path traversal in Metacat 2.x](https://agentprime.io/advisories/CVE-2026-47754.md) `CVE-2026-47754` · CVE record: NCEAS metacat · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal, Broken access control - [systemd-oomd: unprivileged users can terminate arbitrary processes](https://agentprime.io/advisories/CVE-2026-15059.md) `CVE-2026-15059` · CVE record: systemd systemd-oomd · CVSS 5.5 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter](https://agentprime.io/advisories/CVE-2026-72572.md) `CVE-2026-72572` · CVE record: o1lab xmysql · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter](https://agentprime.io/advisories/CVE-2026-72571.md) `CVE-2026-72571` · CVE record: mustafaakin cast-localvideo · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion](https://agentprime.io/advisories/CVE-2026-72569.md) `CVE-2026-72569` · CVE record: cube-root directory-serve · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete](https://agentprime.io/advisories/CVE-2026-72567.md) `CVE-2026-72567` · CVE record: AsyncFuncAI deepwiki-open · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Path Traversal in GNU cpio](https://agentprime.io/advisories/CVE-2026-66484.md) `CVE-2026-66484` · CVE record: GNU cpio · CVSS 4.6 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Path traversal in Samsung Mobile Samsung Health](https://agentprime.io/advisories/CVE-2026-21082.md) `CVE-2026-21082` · CVE record: Samsung Mobile Samsung Health · CVSS 6.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting](https://agentprime.io/advisories/CVE-2026-13170.md) `CVE-2026-13170` · CVE record: Unknown Eventin · CVSS 7.2 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFileSync path traversal](https://agentprime.io/advisories/CVE-2026-19372.md) `CVE-2026-19372` · CVE record: Handwriting-OCR handwriting-ocr-mcp-server · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [Nikolaibibo claude-comfyui-mcp comfy_upload_image utils.ts copyFileSync path traversal](https://agentprime.io/advisories/CVE-2026-19371.md) `CVE-2026-19371` · CVE record: Nikolaibibo claude-comfyui-mcp · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal](https://agentprime.io/advisories/CVE-2026-19370.md) `CVE-2026-19370` · CVE record: bartekke8it56w2 new-mcp · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal](https://agentprime.io/advisories/CVE-2026-19368.md) `CVE-2026-19368` · CVE record: PV-Bhat gemsuite-mcp · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [NocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts path traversal](https://agentprime.io/advisories/CVE-2026-19366.md) `CVE-2026-19366` · CVE record: NocteDefensor LudusMCP · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [Ichigo3766 image-gen-mcp upscale_images index.ts path traversal](https://agentprime.io/advisories/CVE-2026-19365.md) `CVE-2026-19365` · CVE record: Ichigo3766 image-gen-mcp · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [DedeCMS Installation Wizard index.php \_4_Setup file inclusion](https://agentprime.io/advisories/CVE-2026-19353.md) `CVE-2026-19353` · CVE record: DedeCMS · CVSS 2.3 Low · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [automateyournetwork MCPyATS generate_mermaid_markdown index.ts processGenerateRequest path traversal](https://agentprime.io/advisories/CVE-2026-19338.md) `CVE-2026-19338` · CVE record: automateyournetwork MCPyATS · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2026-18465.md) `CVE-2026-18465` · CVE record: Unknown WP MAPS PRO · CVSS 6.5 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips](https://agentprime.io/advisories/CVE-2026-17014.md) `CVE-2026-17014` · CVE record: Unknown WP Photo Album Plus · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal](https://agentprime.io/advisories/CVE-2026-19336.md) `CVE-2026-19336` · CVE record: Pimzino spec-workflow-mcp · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal](https://agentprime.io/advisories/CVE-2026-19335.md) `CVE-2026-19335` · CVE record: Jane-xiaoer skill-vision-control · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .