# Path traversal. File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Windows Error Reporting Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69612.md) `CVE-2026-69612` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows Compressed Folder Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69445.md) `CVE-2026-69445` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows NTFS Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-69425.md) `CVE-2026-69425` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows Setup Files Cleanup Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69289.md) `CVE-2026-69289` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83999.md) `CVE-2026-83999` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 7.0 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Visual Studio Code Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-81377.md) `CVE-2026-81377` · CVE record: Microsoft Visual Studio Code · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-78461.md) `CVE-2026-78461` · CVE record: Microsoft Visual Studio Code · CVSS 7.4 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows Shell Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69383.md) `CVE-2026-69383` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.0 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Microsoft Exchange Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69355.md) `CVE-2026-69355` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows DNS Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-72948.md) `CVE-2026-72948` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows Shell Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-70563.md) `CVE-2026-70563` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows Container Manager Service Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-69771.md) `CVE-2026-69771` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows NTFS Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69379.md) `CVE-2026-69379` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.0 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-68830.md) `CVE-2026-68830` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, Privilege escalation - [Microsoft SQL Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-67368.md) `CVE-2026-67368` · CVE record: Microsoft Microsoft SQL Server 2017 (CU 31) and 4 more · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Microsoft PowerShell Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-62801.md) `CVE-2026-62801` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [NLTK: Corpus Reader Sandbox Bypass](https://agentprime.io/advisories/GHSA-3gq4-3j92-5w49.md) `GHSA-3gq4-3j92-5w49`, `CVE-2026-79674`, `PYSEC-2026-3736` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement](https://agentprime.io/advisories/GHSA-p4rw-rvv2-7xwr.md) `GHSA-p4rw-rvv2-7xwr`, `CVE-2026-79676`, `PYSEC-2026-3737` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely](https://agentprime.io/advisories/GHSA-3hhw-38pf-pxj6.md) `GHSA-3hhw-38pf-pxj6`, `CVE-2026-62383`, `PYSEC-2026-3726` · PyPI `nltk`: affected `>=3.10.0, <3.10.2`, fixed in `3.10.2` · CVSS 6.8 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)](https://agentprime.io/advisories/GHSA-f833-7jw8-xwrv.md) `GHSA-f833-7jw8-xwrv`, `CVE-2026-62384`, `PYSEC-2026-3789` · PyPI `nltk`: affected `>=3.10.0, <3.10.2`, fixed in `3.10.2` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [NLTK: Stable FrameNet and NKJP readers parse outside-root XML](https://agentprime.io/advisories/GHSA-568f-pv23-39p4.md) `GHSA-568f-pv23-39p4`, `CVE-2026-62385`, `PYSEC-2026-3728` · PyPI `nltk`: affected `<3.10.0`, fixed in `3.10.0` · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, CWE-706 - [NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read](https://agentprime.io/advisories/GHSA-x5ph-mj9p-rfr8.md) `GHSA-x5ph-mj9p-rfr8`, `CVE-2026-63312`, `PYSEC-2026-3730` · PyPI `nltk`: affected `<3.10.0`, fixed in `3.10.0` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root](https://agentprime.io/advisories/GHSA-r6gq-whwq-mvg9.md) `GHSA-r6gq-whwq-mvg9`, `CVE-2026-70626`, `PYSEC-2026-3732` · PyPI `nltk`: affected `<3.9.4`, fixed in `3.9.4` · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows](https://agentprime.io/advisories/CVE-2026-74239.md) `CVE-2026-74239` · CVE record: XenForo XenForo · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [CommServe Path Traversal](https://agentprime.io/advisories/CVE-2026-77104.md) `CVE-2026-77104` · CVE record: Commvault Commvault Cloud · CVSS 8.3 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [DataCube Security Feature Bypass](https://agentprime.io/advisories/CVE-2026-77091.md) `CVE-2026-77091` · CVE record: Commvault Commvault Cloud · CVSS 8.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Gnome-tweaks: path traversal in theme installer](https://agentprime.io/advisories/CVE-2026-74859.md) `CVE-2026-74859` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Path traversal in Siemens SIMOVE Fleetmanager V3.1 and others](https://agentprime.io/advisories/CVE-2026-67367.md) `CVE-2026-67367` · CVE record: Siemens SIMOVE Fleetmanager V3.1 and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools](https://agentprime.io/advisories/GHSA-qjrq-cvv4-3g9w.md) `GHSA-qjrq-cvv4-3g9w` · npm `knowns`: affected `*`, no fixed version yet · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal - [knowns before 0.30.0 Path Traversal via Import Name](https://agentprime.io/advisories/CVE-2026-86542.md) `CVE-2026-86542` · CVE record: knowns-dev knowns · CVSS 8.8 High · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [knowns before 0.30.0 Path Traversal via code.replace MCP action](https://agentprime.io/advisories/CVE-2026-86541.md) `CVE-2026-86541` · CVE record: knowns-dev knowns · CVSS 7.2 High · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [knowns before 0.30.0 Path Traversal via templateFile parameter](https://agentprime.io/advisories/CVE-2026-86538.md) `CVE-2026-86538` · CVE record: knowns-dev knowns · CVSS 8.7 High · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [Glib2: toctou symlink race in \`g_file_create_replace_destination\` fallback path](https://agentprime.io/advisories/CVE-2026-86469.md) `CVE-2026-86469` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [Path Traversal in Next4Biz's CSM (Customer Service Management)](https://agentprime.io/advisories/CVE-2026-6377.md) `CVE-2026-6377` · CVE record: Next4Biz Information Technologies Inc. CSM (Customer Service Management) · CVSS 7.5 High · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [Path traversal in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80130.md) `CVE-2026-80130` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.1 High · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [Path traversal in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80131.md) `CVE-2026-80131` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.4 High · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [Path traversal in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80129.md) `CVE-2026-80129` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race](https://agentprime.io/advisories/CVE-2026-86424.md) `CVE-2026-86424` · CVE record: ImageMagick ImageMagick · CVSS 2.0 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race](https://agentprime.io/advisories/CVE-2026-86422.md) `CVE-2026-86422` · CVE record: ImageMagick ImageMagick · CVSS 1.0 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [Path traversal in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80133.md) `CVE-2026-80133` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.4 High · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write](https://agentprime.io/advisories/CVE-2026-78254.md) `CVE-2026-78254` · CVE record: Apache Software Foundation Apache Ant · CVSS 7.4 High · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [External control of a file path in OpenVPN](https://agentprime.io/advisories/CVE-2026-81830.md) `CVE-2026-81830` · CVE record: OpenVPN OpenVPN · CVSS 5.6 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [Path traversal in OpenVPN](https://agentprime.io/advisories/CVE-2026-78043.md) `CVE-2026-78043` · CVE record: OpenVPN OpenVPN · CVSS 5.6 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [Path traversal in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20513.md) `CVE-2026-20513` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 4.4 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Path traversal - [nbviewer through 1.0.1 Path Traversal via LocalFileHandler](https://agentprime.io/advisories/CVE-2026-86258.md) `CVE-2026-86258` · CVE record: jupyter nbviewer · CVSS 8.2 High · Not analysed yet · Published 6 Sept 2026 · Tags: Path traversal - [Unauthenticated file read in Mikrotik RouterOS](https://agentprime.io/advisories/CVE-2026-67281.md) `CVE-2026-67281` · CVE record: Mikrotik RouterOS · CVSS 8.7 High · Not analysed yet · Published 5 Sept 2026 · Tags: Path traversal, Memory corruption - [WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php](https://agentprime.io/advisories/CVE-2026-86189.md) `CVE-2026-86189` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Path traversal - [Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit](https://agentprime.io/advisories/GHSA-3xjw-9qpc-53mh.md) `GHSA-3xjw-9qpc-53mh`, `PYSEC-2026-4010` · PyPI `local-operator`: affected `<0.47.5`, fixed in `0.47.5` · CVSS 7.5 High · Not analysed yet · Published 5 Sept 2026 · Tags: Path traversal, Information disclosure - [Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator](https://agentprime.io/advisories/GHSA-22mg-8gw7-636x.md) `GHSA-22mg-8gw7-636x`, `PYSEC-2026-4009` · PyPI `local-operator`: affected `<0.47.5`, fixed in `0.47.5` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Path traversal - [WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter](https://agentprime.io/advisories/CVE-2026-14975.md) `CVE-2026-14975` · CVE record: JoomUnited WP File Download · CVSS 6.5 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Path traversal - [Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta](https://agentprime.io/advisories/CVE-2026-84898.md) `CVE-2026-84898` · CVE record: Unknown Eventin · CVSS 6.6 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Path traversal - [JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal](https://agentprime.io/advisories/CVE-2025-15693.md) `CVE-2025-15693` · CVE record: Unknown JCH Optimize · CVSS 2.7 Low · Not analysed yet · Published 5 Sept 2026 · Tags: Path traversal - [PassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTL](https://agentprime.io/advisories/CVE-2026-80119.md) `CVE-2026-80119` · CVE record: PassMark Software PerformanceTest and 2 more · CVSS 8.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal, Information disclosure - [PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL](https://agentprime.io/advisories/CVE-2026-80118.md) `CVE-2026-80118` · CVE record: PassMark Software PerformanceTest and 2 more · CVSS 8.4 High · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal, Memory corruption, Information disclosure - [Path traversal in SonicWall Network Security Manager (NSM)](https://agentprime.io/advisories/CVE-2026-81939.md) `CVE-2026-81939` · CVE record: SonicWall Network Security Manager (NSM) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal - [CodeWhale: Argument Injection in \`git_show\` Tool Allows Arbitrary File Write Without Approval](https://agentprime.io/advisories/GHSA-7j5w-7r7x-9v27.md) `GHSA-7j5w-7r7x-9v27`, `CVE-2026-75913` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal, Command injection - [CodeWhale: Project config \`instructions\` override enables arbitrary file read into AI system prompt via cloned repository](https://agentprime.io/advisories/GHSA-62f5-cp2p-vq95.md) `GHSA-62f5-cp2p-vq95`, `CVE-2026-75859` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal, Information disclosure - [Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE](https://agentprime.io/advisories/CVE-2026-53757.md) `CVE-2026-53757` · CVE record: emlog emlog · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal - [CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes](https://agentprime.io/advisories/GHSA-w7wx-5q49-r59w.md) `GHSA-w7wx-5q49-r59w`, `CVE-2026-75914` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal - [Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components](https://agentprime.io/advisories/CVE-2026-14470.md) `CVE-2026-14470` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .