# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db](https://agentprime.io/advisories/GHSA-275h-v5h9-vr82.md)
  `GHSA-275h-v5h9-vr82`, `CVE-2026-59832`, `GO-2026-6350` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260704035520-68cc0f537dfa`, fixed in `0.0.0-20260704035520-68cc0f537dfa` · CVSS 7.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal
- [RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-18672.md)
  `CVE-2026-18672` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal
- [SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field](https://agentprime.io/advisories/CVE-2026-78657.md)
  `CVE-2026-78657` · CVE record: bdthemes SigmaForms Pro – AI Generated Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal
- [MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal](https://agentprime.io/advisories/CVE-2026-84442.md)
  `CVE-2026-84442` · CVE record: MapQuest Get Directions App · CVSS 4.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal
- [WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter](https://agentprime.io/advisories/CVE-2026-14982.md)
  `CVE-2026-14982` · CVE record: JoomUnited WP File Download · CVSS 8.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal
- [Piwigo Image Derivative i.php path traversal](https://agentprime.io/advisories/CVE-2026-84441.md)
  `CVE-2026-84441` · CVE record: Piwigo · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal
- [AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal](https://agentprime.io/advisories/CVE-2026-84431.md)
  `CVE-2026-84431` · CVE record: AirAsia MOVE App · CVSS 4.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal
- [facefusion before 3.7.0 Path Traversal via Job Identifier](https://agentprime.io/advisories/CVE-2026-84702.md)
  `CVE-2026-84702` · CVE record: facefusion facefusion · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal
- [WWBN AVideo Unauthenticated Arbitrary Log File Deletion](https://agentprime.io/advisories/CVE-2026-84478.md)
  `CVE-2026-84478` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Authenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CX](https://agentprime.io/advisories/CVE-2026-73770.md)
  `CVE-2026-73770` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 7.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX](https://agentprime.io/advisories/CVE-2026-73765.md)
  `CVE-2026-73765` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 7.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Authenticated Path Traversal Vulnerability Leads to Remote Unauthorized Access to Files in AOS-CX](https://agentprime.io/advisories/CVE-2026-73760.md)
  `CVE-2026-73760` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX](https://agentprime.io/advisories/CVE-2026-73752.md)
  `CVE-2026-73752` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Unauthenticated Path Traversal in HPE Networking Fabric Composer API Endpoint Allows Unauthorized File Modification](https://agentprime.io/advisories/CVE-2026-73737.md)
  `CVE-2026-73737` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 4.8 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API](https://agentprime.io/advisories/CVE-2026-73720.md)
  `CVE-2026-73720` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 7.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Authenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73719.md)
  `CVE-2026-73719` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 7.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources](https://agentprime.io/advisories/CVE-2026-78592.md)
  `CVE-2026-78592` · CVE record: Elastic Kibana · CVSS 7.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project](https://agentprime.io/advisories/GHSA-2rx9-3g3h-c2jv.md)
  `GHSA-2rx9-3g3h-c2jv` · npm `pnpm`: affected `>=12.0.0-alpha.0, <12.0.0-alpha.5`, fixed in `12.0.0-alpha.5` · CVSS 7.1 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Path traversal in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61753.md)
  `CVE-2026-61753` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [appium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch](https://agentprime.io/advisories/CVE-2026-84201.md)
  `CVE-2026-84201` · CVE record: argneshu appium-mcp-server · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service](https://agentprime.io/advisories/CVE-2024-14047.md)
  `CVE-2024-14047` · CVE record: Elastic Elastic Security · CVSS 7.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag](https://agentprime.io/advisories/CVE-2026-19952.md)
  `CVE-2026-19952` · CVE record: shabti Frontend Admin by DynamiApps · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Path traversal in Sage Employee Self Service](https://agentprime.io/advisories/CVE-2026-67395.md)
  `CVE-2026-67395` · CVE record: Sage Employee Self Service · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Backblaze Client for Windows Improper Link Resolution Vulnerability](https://agentprime.io/advisories/CVE-2026-19820.md)
  `CVE-2026-19820` · CVE record: Backblaze Backblaze Client · CVSS 5.8 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal
- [Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling](https://agentprime.io/advisories/GHSA-9vx2-j98c-p72w.md)
  `GHSA-9vx2-j98c-p72w`, `CVE-2026-75594`, `PKSA-n74d-ghht-18nt` · Packagist `getkirby/cms`: affected `<4.9.5 || >=5.0.0, <5.5.2`, fixed in `4.9.5`, `5.5.2` · CVSS 8.2 High · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [Dokploy Settings application.ts writeTraefikConfigInPath path traversal](https://agentprime.io/advisories/CVE-2026-82954.md)
  `CVE-2026-82954` · CVE record: Dokploy · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [Wallos: Zip Slip path traversal in database restore writes files to webroot](https://agentprime.io/advisories/CVE-2026-61639.md)
  `CVE-2026-61639` · CVE record: ellite Wallos · CVSS 8.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [Path traversal in Eclipse Foundation Eclipse Theia](https://agentprime.io/advisories/CVE-2026-82217.md)
  `CVE-2026-82217` · CVE record: Eclipse Foundation Eclipse Theia · CVSS 8.8 High · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [Apache Wicket: Path traversal in resource style/variation/locale](https://agentprime.io/advisories/CVE-2026-70449.md)
  `CVE-2026-70449` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [ILIAS Arbitrary File Read via SOAP addFile](https://agentprime.io/advisories/CVE-2026-82877.md)
  `CVE-2026-82877` · CVE record: ILIAS-eLearning e.V. ILIAS · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message](https://agentprime.io/advisories/GHSA-h3hj-cmcx-xc66.md)
  `GHSA-h3hj-cmcx-xc66` · npm `nodemailer`: affected `<=9.0.0`, no fixed version yet · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal](https://agentprime.io/advisories/CVE-2026-82665.md)
  `CVE-2026-82665` · CVE record: yaojingang GEOFlow · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [Path traversal in AshAdmin file uploads via unsanitized client filename](https://agentprime.io/advisories/GHSA-483p-rgcq-p5j9.md)
  `GHSA-483p-rgcq-p5j9`, `CVE-2026-82673`, `EEF-CVE-2026-82673` · Hex `ash_admin`: affected `>=0.13.7, <1.3.1`, fixed in `1.3.1` · CVSS 8.3 High · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [SeaCMS Comment Cache member.php del_pl path traversal](https://agentprime.io/advisories/CVE-2026-82603.md)
  `CVE-2026-82603` · CVE record: SeaCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [SeaCMS Avatar Upload member.php unlink path traversal](https://agentprime.io/advisories/CVE-2026-82599.md)
  `CVE-2026-82599` · CVE record: SeaCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo…](https://agentprime.io/advisories/CVE-2026-79407.md)
  `CVE-2026-79407` · CVE record · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [AJCloud AJY IPC Firmware Path Traversal via jdbhttpd](https://agentprime.io/advisories/CVE-2026-56718.md)
  `CVE-2026-56718` · CVE record: AJCloud AJY IPC Firmware · CVSS 8.7 High · Not analysed yet · Published 30 Aug 2026 · Tags: Path traversal
- [Admidio before 5.0.12 Path Traversal via Photo ZIP Download](https://agentprime.io/advisories/CVE-2026-82656.md)
  `CVE-2026-82656` · CVE record: Admidio admidio · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Path traversal
- [browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation](https://agentprime.io/advisories/CVE-2026-82637.md)
  `CVE-2026-82637` · CVE record: browser-use web-ui · CVSS 6.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Path traversal
- [Pake arbitrary file write via unsanitized download_file filename](https://agentprime.io/advisories/CVE-2026-82635.md)
  `CVE-2026-82635` · CVE record: tw93 Pake · CVSS 8.8 High · Not analysed yet · Published 30 Aug 2026 · Tags: Path traversal
- [WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore](https://agentprime.io/advisories/CVE-2026-19722.md)
  `CVE-2026-19722` · CVE record: Unknown WPvivid — Backup, Migration & Staging · CVSS 6.6 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Path traversal
- [Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown](https://agentprime.io/advisories/CVE-2026-82460.md)
  `CVE-2026-82460` · CVE record: coderaiser cloudcmd · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Aug 2026 · Tags: Path traversal
- [SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read](https://agentprime.io/advisories/GHSA-56wq-x3wv-3ff4.md)
  `GHSA-56wq-x3wv-3ff4`, `BIT-seaweedfs-2026-55874`, `CVE-2026-55874`, `GO-2026-6327` · Go `github.com/seaweedfs/seaweedfs`: affected `<0.0.0-20260612000715-b44cf51fe931`, fixed in `0.0.0-20260612000715-b44cf51fe931` · CVSS 7.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities](https://agentprime.io/advisories/CVE-2026-18899.md)
  `CVE-2026-18899` · CVE record: IBM Langflow OSS · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Path traversal in the aws:downloadContent plugin in amazon-ssm-agent](https://agentprime.io/advisories/CVE-2026-81849.md)
  `CVE-2026-81849` · CVE record: amazon amazon-ssm-agent · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Snipe-IT vulnerable to directory traversal in displaySig](https://agentprime.io/advisories/GHSA-c6f4-wj38-m3g3.md)
  `GHSA-c6f4-wj38-m3g3`, `CVE-2026-55474`, `PKSA-b2sw-ngv6-5kt1` · Packagist `snipe/snipe-it`: affected `<8.5.0`, fixed in `8.5.0` · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Snipe-IT has a path traversal vulnerability via CSV import \`image\` field](https://agentprime.io/advisories/GHSA-xr9m-gphc-9p63.md)
  `GHSA-xr9m-gphc-9p63`, `CVE-2026-55469`, `PKSA-4bks-zvdb-53gs` · Packagist `snipe/snipe-it`: affected `<8.6.2`, fixed in `8.6.2` · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-66324.md)
  `CVE-2026-66324` · CVE record: Microsoft Microsoft Edge (Chromium-based) and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Yamcs has Unauthenticated Directory Traversal](https://agentprime.io/advisories/GHSA-9jg3-g3wh-w9pj.md)
  `GHSA-9jg3-g3wh-w9pj`, `CVE-2026-55552` · Maven `org.yamcs:yamcs-core`: affected `<5.12.0`, fixed in `5.12.0` · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory](https://agentprime.io/advisories/GHSA-mf5c-hw34-4hpp.md)
  `GHSA-mf5c-hw34-4hpp`, `CVE-2026-55569`, `GO-2026-6314` · Go `github.com/aquaproj/aqua/v2`: affected `<2.60.1`, fixed in `2.60.1` · CVSS 6.6 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [gpt-crawler Arbitrary File Write via outputFileName Parameter](https://agentprime.io/advisories/CVE-2026-82286.md)
  `CVE-2026-82286` · CVE record: BuilderIO gpt-crawler · CVSS 8.8 High · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Qwen-Agent Arbitrary File Read via Caller-Supplied Document Path](https://agentprime.io/advisories/CVE-2026-82275.md)
  `CVE-2026-82275` · CVE record: QwenLM Qwen-Agent · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths](https://agentprime.io/advisories/CVE-2026-82264.md)
  `CVE-2026-82264` · CVE record: gilbertchen duplicacy · CVSS 6.1 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [KubeVela Terraform remote loader DoS via unbounded file read](https://agentprime.io/advisories/GHSA-fmgp-q6jx-gg3x.md)
  `GHSA-fmgp-q6jx-gg3x`, `CVE-2026-55108`, `GO-2026-6312` · Go `github.com/oam-dev/kubevela`: affected `<1.9.14 || >=1.10.0-alpha.1, <1.10.9 || >=1.11.0-alpha.1, <1.11.0-alpha.4`, fixed in `1.9.14`, `1.10.9`, `1.11.0-alpha.4` · CVSS 8.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal, Denial of service
- [houtini-ai houtini-lm code_task_files index.ts path traversal](https://agentprime.io/advisories/CVE-2026-82112.md)
  `CVE-2026-82112` · CVE record: houtini-ai houtini-lm · CVSS 5.1 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal](https://agentprime.io/advisories/CVE-2026-82111.md)
  `CVE-2026-82111` · CVE record: iswalle getnote-mcp · CVSS 5.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [gitoxide before 0.33.0 Path Traversal via symlink following](https://agentprime.io/advisories/CVE-2026-82248.md)
  `CVE-2026-82248` · CVE record: GitoxideLabs gitoxide · CVSS 6.0 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-19084.md)
  `CVE-2026-19084` · CVE record: Unknown shared-files-pro · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal](https://agentprime.io/advisories/CVE-2026-12513.md)
  `CVE-2026-12513` · CVE record: Unknown Shared Files and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal
- [file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation.](https://agentprime.io/advisories/CVE-2026-38093.md)
  `CVE-2026-38093` · CVE record · CVSS 3.3 Low · Not analysed yet · Published 28 Aug 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA4LTI4VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi0zODA5MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTA5LTAyVDE0OjI3OjE2LjAwMDAwMFoiLCJHSFNBLXA0OTgtdjQzNy00NzJnIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTA5LTAyVDE0OjI3OjE2LjAwMDAwMFoiLCJHSFNBLXA0OTgtdjQzNy00NzJnIl0>. Everything for agents: <https://agentprime.io/llms.txt>.