# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)](https://agentprime.io/advisories/CVE-2026-61800.md)
  `CVE-2026-61800` · CVE record: wazuh wazuh · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion](https://agentprime.io/advisories/CVE-2026-54083.md)
  `CVE-2026-54083` · CVE record: wazuh wazuh · CVSS 8.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal](https://agentprime.io/advisories/CVE-2026-81847.md)
  `CVE-2026-81847` · CVE record: MAA-AI MaaMCP · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal](https://agentprime.io/advisories/CVE-2026-81845.md)
  `CVE-2026-81845` · CVE record: arben-adm mcp-sequential-thinking · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal](https://agentprime.io/advisories/CVE-2026-81837.md)
  `CVE-2026-81837` · CVE record: RooCodeInc Roo-Code · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename](https://agentprime.io/advisories/CVE-2026-81730.md)
  `CVE-2026-81730` · CVE record: Dolibarr dolibarr · CVSS 8.8 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)](https://agentprime.io/advisories/CVE-2026-81838.md)
  `CVE-2026-81838` · CVE record: aws diagram-as-code · CVSS 6.8 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature](https://agentprime.io/advisories/CVE-2026-53580.md)
  `CVE-2026-53580` · CVE record: TriliumNext Trilium · CVSS 8.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal, Denial of service, Information disclosure
- [Duplicate Advisory: Model-artifact APIs bypass pathsec and touch files outside allowed roots](https://agentprime.io/advisories/GHSA-hqj7-phwp-c3fp.md)
  `GHSA-hqj7-phwp-c3fp` · PyPI `nltk`: affected `<=3.10.3`, no fixed version yet · CVSS 7.0 High · Withdrawn · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Duplicate Advisory: Downloader.download follows hardlinks and overwrites outside-root files](https://agentprime.io/advisories/GHSA-4xw3-jf9x-x7mf.md)
  `GHSA-4xw3-jf9x-x7mf` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation](https://agentprime.io/advisories/CVE-2026-59311.md)
  `CVE-2026-59311` · CVE record: Spring Spring Integration · CVSS 6.8 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Arbitrary File Write via Path Traversal in ResourceCacheService](https://agentprime.io/advisories/CVE-2026-59294.md)
  `CVE-2026-59294` · CVE record: Spring Spring AI · CVSS 5.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal](https://agentprime.io/advisories/CVE-2026-76639.md)
  `CVE-2026-76639` · CVE record: Unitree Robotics G1 EDU · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal, Authentication bypass
- [libreoffice-convert vulnerable to path traversal / arbitrary file write](https://agentprime.io/advisories/GHSA-gmxc-r82q-347r.md)
  `GHSA-gmxc-r82q-347r`, `CVE-2026-54732` · npm `libreoffice-convert`: affected `<1.8.2`, fixed in `1.8.2` · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox.\_is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed...](https://agentprime.io/advisories/GHSA-vr4h-5xqv-xxxf.md)
  `GHSA-vr4h-5xqv-xxxf`, `CVE-2026-81716`, `PYSEC-2026-3800` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not de...](https://agentprime.io/advisories/GHSA-hw7h-wqf5-6crx.md)
  `GHSA-hw7h-wqf5-6crx`, `CVE-2026-81690`, `PYSEC-2026-3796` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)](https://agentprime.io/advisories/GHSA-q7m3-rhxg-7vxr.md)
  `GHSA-q7m3-rhxg-7vxr`, `CVE-2026-54687` · npm `n8n-nodes-sqlite3`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 6.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Spring Framework Path Traversal via Backslash in SpringTemplateLoader](https://agentprime.io/advisories/CVE-2026-59280.md)
  `CVE-2026-59280` · CVE record: Spring Spring Framework · CVSS 4.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Path traversal in Eclipse Foundation Eclipse SW360](https://agentprime.io/advisories/CVE-2026-79653.md)
  `CVE-2026-79653` · CVE record: Eclipse Foundation Eclipse SW360 · CVSS 6.0 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Arbitrary File Overwrite via Symlink Following in dool project](https://agentprime.io/advisories/CVE-2026-56651.md)
  `CVE-2026-56651` · CVE record: scottchiefbaker dool · CVSS 2.0 Low · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Volmarg Personal Management System Path Traversal via get-file Endpoint](https://agentprime.io/advisories/CVE-2026-40526.md)
  `CVE-2026-40526` · CVE record: Volmarg personal-management-system · CVSS 7.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection](https://agentprime.io/advisories/CVE-2026-81743.md)
  `CVE-2026-81743` · CVE record: flowintel flowintel · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal, Code injection
- [blackms aistack Static File server.ts path traversal](https://agentprime.io/advisories/CVE-2026-81560.md)
  `CVE-2026-81560` · CVE record: blackms aistack · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing](https://agentprime.io/advisories/CVE-2026-81659.md)
  `CVE-2026-81659` · CVE record: flowintel flowintel · CVSS 7.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-78275.md)
  `CVE-2026-78275` · CVE record: WP Manage Ninja Fluent Boards Pro · CVSS 6.8 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Local Privilege Escalation in CodeMeter Runtime on Windows](https://agentprime.io/advisories/CVE-2026-81572.md)
  `CVE-2026-81572` · CVE record: wibu-systems-ag codemeter-runtime · CVSS 7.8 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Spring Framework Improper Path Limitation in XsltView](https://agentprime.io/advisories/GHSA-pc63-qcmh-9cmg.md)
  `GHSA-pc63-qcmh-9cmg`, `CVE-2026-47884` · Maven `org.springframework:spring-webmvc`: affected `<=5.2.25.RELEASE || >=5.3.0, <=5.3.49 || >=6.0.0, <=6.0.30 || >=6.1.0, <=6.1.28 || >=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9`, fixed in `7.0.9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment](https://agentprime.io/advisories/CVE-2026-77016.md)
  `CVE-2026-77016` · CVE record: Unknown Workeera · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [boxpositron with-context-mcp index.ts project_folder path traversal](https://agentprime.io/advisories/CVE-2026-81491.md)
  `CVE-2026-81491` · CVE record: boxpositron with-context-mcp · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal](https://agentprime.io/advisories/CVE-2026-81486.md)
  `CVE-2026-81486` · CVE record: bsmi021 mcp-file-context-server · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [danielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal](https://agentprime.io/advisories/CVE-2026-81485.md)
  `CVE-2026-81485` · CVE record: danielpopamd linkedin-ads-mcp · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows.](https://agentprime.io/advisories/CVE-2026-75418.md)
  `CVE-2026-75418` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal.](https://agentprime.io/advisories/CVE-2026-75337.md)
  `CVE-2026-75337` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any p…](https://agentprime.io/advisories/CVE-2026-37068.md)
  `CVE-2026-37068` · CVE record · CVSS 8.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator r…](https://agentprime.io/advisories/CVE-2026-37066.md)
  `CVE-2026-37066` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.](https://agentprime.io/advisories/CVE-2026-37007.md)
  `CVE-2026-37007` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [ZipTransformer uses file_name header to build workDirectory path without sanitization](https://agentprime.io/advisories/CVE-2026-47862.md)
  `CVE-2026-47862` · CVE record: Spring Spring Integration · CVSS 5.4 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [Symlink following in WebPros Plesk Migrator and others](https://agentprime.io/advisories/CVE-2026-65647.md)
  `CVE-2026-65647` · CVE record: WebPros Plesk Migrator and 1 more · CVSS 8.7 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)](https://agentprime.io/advisories/CVE-2026-61792.md)
  `CVE-2026-61792` · CVE record: WeblateOrg weblate · CVSS 7.7 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal, CWE-693
- [Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint](https://agentprime.io/advisories/CVE-2026-81030.md)
  `CVE-2026-81030` · CVE record: mage-ai mage-ai · CVSS 7.1 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision](https://agentprime.io/advisories/CVE-2026-81028.md)
  `CVE-2026-81028` · CVE record: ZLMediaKit ZLMediaKit · CVSS 6.9 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [asyncssh has SCP Path Traversal to Arbitrary File Write](https://agentprime.io/advisories/GHSA-2wxc-x7rj-hg8f.md)
  `GHSA-2wxc-x7rj-hg8f`, `CVE-2026-54591`, `PYSEC-2026-3808` · PyPI `asyncssh`: affected `<2.23.1`, fixed in `2.23.1` · CVSS 8.1 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading \~ (and weakly via ${ENV}) username substitution](https://agentprime.io/advisories/GHSA-qr67-gv47-xwwh.md)
  `GHSA-qr67-gv47-xwwh`, `CVE-2026-54590`, `PYSEC-2026-3809` · PyPI `asyncssh`: affected `<2.23.1`, fixed in `2.23.1` · CVSS 5.9 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal, Broken access control
- [IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries](https://agentprime.io/advisories/GHSA-f63g-88cj-hjf9.md)
  `GHSA-f63g-88cj-hjf9`, `CVE-2026-54550` · Maven `org.codehaus.izpack:izpack-installer`: affected `<5.2.7`, fixed in `5.2.7` · CVSS 7.4 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter](https://agentprime.io/advisories/CVE-2026-15990.md)
  `CVE-2026-15990` · CVE record: Strategy11 Formidable Charts · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [RustDesk Path Traversal via macOS Clipboard File-Paste](https://agentprime.io/advisories/CVE-2026-73102.md)
  `CVE-2026-73102` · CVE record: rustdesk rustdesk · CVSS 6.9 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings](https://agentprime.io/advisories/CVE-2026-59683.md)
  `CVE-2026-59683` · CVE record: CalcProgrammer1 OpenRGB · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [Arbitrary file overwrite and deletion local and remote in OpenRGB](https://agentprime.io/advisories/CVE-2026-59682.md)
  `CVE-2026-59682` · CVE record: CalcProgrammer1 OpenRGB · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [Improper Validation of File Paths in TeamViewer Desktop Clients](https://agentprime.io/advisories/CVE-2026-16444.md)
  `CVE-2026-16444` · CVE record: TeamViewer Full Client, Host, QuickSupport & Portable and 4 more · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission](https://agentprime.io/advisories/CVE-2026-77757.md)
  `CVE-2026-77757` · CVE record: Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads · CVSS 5.4 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax](https://agentprime.io/advisories/CVE-2026-77693.md)
  `CVE-2026-77693` · CVE record: Unknown Order Tip for WooCommerce · CVSS 8.7 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter](https://agentprime.io/advisories/CVE-2026-75797.md)
  `CVE-2026-75797` · CVE record: Unknown AI Engine · CVSS 7.7 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [yx-image-recognition v1.0 is vulnerable to Path Traversal.](https://agentprime.io/advisories/CVE-2026-75333.md)
  `CVE-2026-75333` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability:](https://agentprime.io/advisories/CVE-2026-75328.md)
  `CVE-2026-75328` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration.](https://agentprime.io/advisories/CVE-2026-36851.md)
  `CVE-2026-36851` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [TypeBot: Arbitrary server file read via Send Email block attachment path](https://agentprime.io/advisories/CVE-2026-62865.md)
  `CVE-2026-62865` · CVE record: baptisteArno typebot.io · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: Path traversal, Information disclosure
- [DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename](https://agentprime.io/advisories/CVE-2026-80104.md)
  `CVE-2026-80104` · CVE record: eosphoros-ai DB-GPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Path traversal
- [Path traversal in NVIDIA OpenShell](https://agentprime.io/advisories/CVE-2026-65092.md)
  `CVE-2026-65092` · CVE record: NVIDIA OpenShell · CVSS 8.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Path traversal
- [Symlink following in SonicWall NetExtender](https://agentprime.io/advisories/CVE-2026-66153.md)
  `CVE-2026-66153` · CVE record: SonicWall NetExtender · CVSS 7.0 High · Not analysed yet · Published 25 Aug 2026 · Tags: Path traversal
- [consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write](https://agentprime.io/advisories/GHSA-xc9g-j69q-37xw.md)
  `GHSA-xc9g-j69q-37xw`, `CVE-2026-55609` · npm `consciousness-explorer` and 1 more: affected `<1.1.2`, fixed in `1.1.2` · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA4LTI1VDE4OjM1OjMyLjAwMDAwMFoiLCJHSFNBLXhjOWctajY5cS0zN3h3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTA4LTI4VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi0zODA5MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTA4LTI4VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi0zODA5MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.