# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction](https://agentprime.io/advisories/CVE-2026-89021.md)
  `CVE-2026-89021` · CVE record: MikroTik RouterOS · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket](https://agentprime.io/advisories/CVE-2026-90946.md)
  `CVE-2026-90946` · CVE record: AsyncFuncAI deepwiki-open · CVSS 8.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following](https://agentprime.io/advisories/CVE-2026-90807.md)
  `CVE-2026-90807` · CVE record: nanocoai NanoClaw · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Cisco Secure Email Gateway Security Hardening Release](https://agentprime.io/advisories/CVE-2026-76440.md)
  `CVE-2026-76440` · CVE record: Cisco Cisco Secure Email and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name](https://agentprime.io/advisories/CVE-2026-82427.md)
  `CVE-2026-82427` · CVE record: Apache Software Foundation Apache Storm Nimbus · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys](https://agentprime.io/advisories/CVE-2026-82428.md)
  `CVE-2026-82428` · CVE record: Apache Software Foundation Apache Storm Client · CVSS 8.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location](https://agentprime.io/advisories/CVE-2026-82426.md)
  `CVE-2026-82426` · CVE record: Apache Software Foundation Apache Storm Nimbus · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Eclipse Foundation Eclipse Embedded CDT (C/C++ Development Tools)](https://agentprime.io/advisories/CVE-2026-78299.md)
  `CVE-2026-78299` · CVE record: Eclipse Foundation Eclipse Embedded CDT (C/C++ Development Tools) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE](https://agentprime.io/advisories/CVE-2026-90932.md)
  `CVE-2026-90932` · CVE record: laradashboard laradashboard · CVSS 8.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [File Browser through 2.63.23 Path Traversal via Symlink Alias](https://agentprime.io/advisories/CVE-2026-90930.md)
  `CVE-2026-90930` · CVE record: filebrowser filebrowser · CVSS 7.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0](https://agentprime.io/advisories/CVE-2026-81565.md)
  `CVE-2026-81565` · CVE record: joomshaper.com SP Page Builder (Free and Pro) extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0](https://agentprime.io/advisories/CVE-2026-81564.md)
  `CVE-2026-81564` · CVE record: joomshaper.com SP Page Builder (Free and Pro) extension for Joomla · CVSS 7.0 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Contec Co., Ltd. FXA5000 and others](https://agentprime.io/advisories/CVE-2026-82765.md)
  `CVE-2026-82765` · CVE record: Contec Co., Ltd. FXA5000 and 4 more · CVSS 8.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal](https://agentprime.io/advisories/CVE-2026-90691.md)
  `CVE-2026-90691` · CVE record: 0x4m4 HexStrike AI · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Contec Co., Ltd. SGA1000](https://agentprime.io/advisories/CVE-2026-82768.md)
  `CVE-2026-82768` · CVE record: Contec Co., Ltd. SGA1000 · CVSS 8.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Paessler PRTG Network Monitor](https://agentprime.io/advisories/CVE-2023-45858.md)
  `CVE-2023-45858` · CVE record: Paessler PRTG Network Monitor · CVSS 8.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in DataEase](https://agentprime.io/advisories/CVE-2023-40772.md)
  `CVE-2023-40772` · CVE record: DataEase DataEase · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in ILIAS](https://agentprime.io/advisories/CVE-2023-32778.md)
  `CVE-2023-32778` · CVE record: ILIAS ILIAS · CVSS 3.3 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Softing Secure Integration Server](https://agentprime.io/advisories/CVE-2023-29377.md)
  `CVE-2023-29377` · CVE record: Softing Secure Integration Server · CVSS 6.6 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [rustypaste before 0.18.1 Path Traversal via filename header](https://agentprime.io/advisories/CVE-2026-90774.md)
  `CVE-2026-90774` · CVE record: orhun rustypaste · CVSS 8.7 High · Not analysed yet · Published 13 Sept 2026 · Tags: Path traversal
- [restify node-restify static.js serveStatic path traversal](https://agentprime.io/advisories/CVE-2026-90494.md)
  `CVE-2026-90494` · CVE record: restify node-restify · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Path traversal
- [Path traversal in Zettlab D6 Ultra](https://agentprime.io/advisories/CVE-2025-70820.md)
  `CVE-2025-70820` · CVE record: Zettlab D6 Ultra · CVSS 3.5 Low · Not analysed yet · Published 13 Sept 2026 · Tags: Path traversal
- [Path traversal in Zettlab D6 Ultra](https://agentprime.io/advisories/CVE-2025-70819.md)
  `CVE-2025-70819` · CVE record: Zettlab D6 Ultra · CVSS 6.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Path traversal
- [WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal](https://agentprime.io/advisories/CVE-2026-77006.md)
  `CVE-2026-77006` · CVE record: Unknown WebTotem Backups · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Path traversal
- [Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal](https://agentprime.io/advisories/CVE-2026-77005.md)
  `CVE-2026-77005` · CVE record: Unknown CODE MONKEYS PROPOSALS · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Path traversal
- [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab](https://agentprime.io/advisories/CVE-2026-85706.md)
  `CVE-2026-85706` · CVE record: GitLab GitLab · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.97 · Not analysed yet · Published 12 Sept 2026 · Tags: Path traversal
- [@Mockoon/commons-server: Path traversal in templated \`filePath\` lets a request escape the served directory (prefix-only base check)](https://agentprime.io/advisories/GHSA-8wqc-v2q8-vff2.md)
  `GHSA-8wqc-v2q8-vff2`, `CVE-2026-59149` · npm `@mockoon/cli` and 1 more: affected `<9.7.0`, fixed in `9.7.0` · CVSS 6.5 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Path Traversal in Malcolm](https://agentprime.io/advisories/CVE-2026-90445.md)
  `CVE-2026-90445` · CVE record: CISA Malcolm · CVSS 7.1 High · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [libks has path traversal in kws HTTP parser via URI segment overflow](https://agentprime.io/advisories/CVE-2026-49846.md)
  `CVE-2026-49846` · CVE record: signalwire libks · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal, CWE-697
- [tarfile hardlink fallback ignores custom extraction filter rejection via None](https://agentprime.io/advisories/CVE-2026-87910.md)
  `CVE-2026-87910` · CVE record: Python Software Foundation CPython · CVSS 5.7 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Relative path traversal in the generated file manifest cleanup component in projen](https://agentprime.io/advisories/CVE-2026-89065.md)
  `CVE-2026-89065` · CVE record: AWS projen · CVSS 6.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server](https://agentprime.io/advisories/CVE-2026-89009.md)
  `CVE-2026-89009` · CVE record: WAVLINK Technology WN535M1 and 1 more · CVSS 8.8 High · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Path traversal in mistralai mistral-vibe](https://agentprime.io/advisories/CVE-2026-87984.md)
  `CVE-2026-87984` · CVE record: mistralai mistral-vibe · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Path traversal in mistralai mistral-vibe](https://agentprime.io/advisories/CVE-2026-87983.md)
  `CVE-2026-87983` · CVE record: mistralai mistral-vibe · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get](https://agentprime.io/advisories/CVE-2026-89258.md)
  `CVE-2026-89258` · CVE record: gohugoio hugo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Path traversal in appleple inc. a-blog cms](https://agentprime.io/advisories/CVE-2026-87727.md)
  `CVE-2026-87727` · CVE record: appleple inc. a-blog cms · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion](https://agentprime.io/advisories/CVE-2026-19991.md)
  `CVE-2026-19991` · CVE record: stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP · CVSS 8.1 High · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input.](https://agentprime.io/advisories/CVE-2025-69904.md)
  `CVE-2025-69904` · CVE record · CVSS 4.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user\[name\]' Parameter](https://agentprime.io/advisories/CVE-2026-77807.md)
  `CVE-2026-77807` · CVE record: acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace](https://agentprime.io/advisories/GHSA-66hp-wgxq-6f5q.md)
  `GHSA-66hp-wgxq-6f5q`, `BIT-rclone-2026-88014`, `CVE-2026-88014`, `GO-2026-6464` · Go `github.com/rclone/rclone`: affected `>=1.72.0, <1.75.1`, fixed in `1.75.1` · CVSS 6.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination](https://agentprime.io/advisories/GHSA-f8g7-2xjc-7mfh.md)
  `GHSA-f8g7-2xjc-7mfh`, `BIT-rclone-2026-88016`, `CVE-2026-88016`, `GO-2026-6459` · Go `github.com/rclone/rclone`: affected `<1.75.1`, fixed in `1.75.1` · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal, CWE-281
- [rclone: source object names can escape the configured root on upload](https://agentprime.io/advisories/GHSA-38xv-hf3p-h7mq.md)
  `GHSA-38xv-hf3p-h7mq`, `BIT-rclone-2026-88046`, `CVE-2026-88046`, `GO-2026-6457` · Go `github.com/rclone/rclone`: affected `<1.75.1`, fixed in `1.75.1` · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url](https://agentprime.io/advisories/GHSA-wfgq-w7cq-qj7j.md)
  `GHSA-wfgq-w7cq-qj7j` · crates.io `mistralrs-server-core`: affected `<0.8.18`, fixed in `0.8.18` · CVSS 7.2 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-80424.md)
  `CVE-2026-80424` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Suricata datasets: save to absolute filename can be bypassed when combined with load command](https://agentprime.io/advisories/CVE-2026-45767.md)
  `CVE-2026-45767` · CVE record: OISF suricata · CVSS 4.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-81540.md)
  `CVE-2026-81540` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-81551.md)
  `CVE-2026-81551` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-81554.md)
  `CVE-2026-81554` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-82092.md)
  `CVE-2026-82092` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-82100.md)
  `CVE-2026-82100` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem](https://agentprime.io/advisories/CVE-2026-84889.md)
  `CVE-2026-84889` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system](https://agentprime.io/advisories/CVE-2026-86087.md)
  `CVE-2026-86087` · CVE record: IBM Db2 · CVSS 4.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [n8n: Git Node branch.\<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read](https://agentprime.io/advisories/GHSA-qgpw-8g46-w95v.md)
  `GHSA-qgpw-8g46-w95v`, `CVE-2026-86995` · npm `n8n`: affected `<1.123.76 || >=2.0.0, <2.37.7 || >=2.38.0, <2.38.2`, fixed in `1.123.76`, `2.37.7`, `2.38.2` · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers](https://agentprime.io/advisories/GHSA-f2cp-m7mv-8jpv.md)
  `GHSA-f2cp-m7mv-8jpv`, `CVE-2026-86079` · npm `n8n`: affected `<1.123.76 || >=2.0.0, <2.37.7 || >=2.38.0, <2.38.2`, fixed in `1.123.76`, `2.37.7`, `2.38.2` · CVSS 6.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600](https://agentprime.io/advisories/CVE-2026-76652.md)
  `CVE-2026-76652` · CVE record: TP-Link Systems Inc. TL-MR6400 v8 and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem](https://agentprime.io/advisories/GHSA-w47m-jpv2-qfw5.md)
  `GHSA-w47m-jpv2-qfw5` · npm `knowns`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Path traversal in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-68487.md)
  `CVE-2026-68487` · CVE record: WebPros Plesk · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint](https://agentprime.io/advisories/CVE-2026-88940.md)
  `CVE-2026-88940` · CVE record: knowns-dev knowns · CVSS 6.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [knowns through 0.33.0 Path Traversal via code.find MCP tool](https://agentprime.io/advisories/CVE-2026-88938.md)
  `CVE-2026-88938` · CVE record: knowns-dev knowns · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [knowns through 0.33.0 Path Traversal via Template Engine](https://agentprime.io/advisories/CVE-2026-88937.md)
  `CVE-2026-88937` · CVE record: knowns-dev knowns · CVSS 8.6 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA5LTEwVDE1OjI4OjUyLjUwNzAwMFoiLCJDVkUtMjAyNi04ODkzNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTA5LTE0VDE4OjI2OjU5Ljc1NjAwMFoiLCJDVkUtMjAyNi0xODUxNSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTA5LTE0VDE4OjI2OjU5Ljc1NjAwMFoiLCJDVkUtMjAyNi0xODUxNSJd>. Everything for agents: <https://agentprime.io/llms.txt>.