# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching](https://agentprime.io/advisories/CVE-2026-92812.md)
  `CVE-2026-92812` · CVE record: decaporg decap-cms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Uber Kraken through 0.1.29 Path Traversal via tag parameter](https://agentprime.io/advisories/CVE-2026-92791.md)
  `CVE-2026-92791` · CVE record: uber kraken · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [BC Security Empire before 6.7.1 Path Traversal File Upload RCE](https://agentprime.io/advisories/CVE-2026-92748.md)
  `CVE-2026-92748` · CVE record: BC-SECURITY Empire · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Cisco Identity Services Engine Arbitrary File Deletion Vulnerability](https://agentprime.io/advisories/CVE-2026-76431.md)
  `CVE-2026-76431` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Cisco Identity Services Engine Arbitrary File Write Vulnerability](https://agentprime.io/advisories/CVE-2026-76432.md)
  `CVE-2026-76432` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Cisco Identity Services Engine Arbitrary File Read Vulnerability](https://agentprime.io/advisories/CVE-2026-76434.md)
  `CVE-2026-76434` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Cisco Identity Services Engine Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-76433.md)
  `CVE-2026-76433` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Cisco ISE Arbitrary File Access Vulnerability](https://agentprime.io/advisories/CVE-2026-76424.md)
  `CVE-2026-76424` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Limitation of a Pathname](https://agentprime.io/advisories/CVE-2026-76409.md)
  `CVE-2026-76409` · CVE record: Cisco Cisco Nexus Dashboard · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-89084.md)
  `CVE-2026-89084` · CVE record: HP Inc HP AC Print & Scan and 1 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles](https://agentprime.io/advisories/CVE-2026-87976.md)
  `CVE-2026-87976` · CVE record: Apache Software Foundation Apache NiFi Registry · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Scirius through 3.8.0 Arbitrary File Write via PCAP Upload](https://agentprime.io/advisories/CVE-2026-92604.md)
  `CVE-2026-92604` · CVE record: StamusNetworks scirius · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Symlink following in Dell Update Package Framework](https://agentprime.io/advisories/CVE-2026-71182.md)
  `CVE-2026-71182` · CVE record: Dell Update Package Framework · CVSS 3.0 Low · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Symlink following in Dell Update Package Framework](https://agentprime.io/advisories/CVE-2026-71181.md)
  `CVE-2026-71181` · CVE record: Dell Update Package Framework · CVSS 3.0 Low · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Stanza: Zip Slip Path Traversal in Model/Resource Extraction](https://agentprime.io/advisories/CVE-2026-59974.md)
  `CVE-2026-59974` · CVE record: stanfordnlp stanza · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Path traversal in Jenkins Project Jenkins Robot Framework Plugin](https://agentprime.io/advisories/CVE-2026-92137.md)
  `CVE-2026-92137` · CVE record: Jenkins Project Jenkins Robot Framework Plugin · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Path traversal in Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin](https://agentprime.io/advisories/CVE-2026-92131.md)
  `CVE-2026-92131` · CVE record: Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin · CVSS 4.2 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [@zereight/mcp-gitlab: Unauthenticated arbitrary file read via \`upload_markdown\` enables PAT exfiltration and full account takeover](https://agentprime.io/advisories/GHSA-cv3r-c5h8-f4g5.md)
  `GHSA-cv3r-c5h8-f4g5`, `CVE-2026-61560` · npm `@zereight/mcp-gitlab`: affected `<2.1.27`, fixed in `2.1.27` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [External control of a file path in Advantech EKI-1242IEIMS and others](https://agentprime.io/advisories/CVE-2026-73171.md)
  `CVE-2026-73171` · CVE record: Advantech EKI-1242IEIMS and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Path Traversal in /index.php/view_uploaded_iodd_file](https://agentprime.io/advisories/CVE-2026-27557.md)
  `CVE-2026-27557` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Path traversal in Octopus Deploy Octopus Server](https://agentprime.io/advisories/CVE-2026-92355.md)
  `CVE-2026-92355` · CVE record: Octopus Deploy Octopus Server · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal](https://agentprime.io/advisories/CVE-2026-76555.md)
  `CVE-2026-76555` · CVE record: Unknown WP Import Export Lite · CVSS 6.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path Traversal](https://agentprime.io/advisories/CVE-2026-76553.md)
  `CVE-2026-76553` · CVE record: Unknown WP Import Export Lite · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Path traversal in Oracle Corporation Oracle GraalVM for JDK, Oracle GraalVM](https://agentprime.io/advisories/CVE-2026-83357.md)
  `CVE-2026-83357` · CVE record: Oracle Corporation Oracle GraalVM for JDK, Oracle GraalVM · CVSS 8.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Symlink following in Webpros SolusVM](https://agentprime.io/advisories/CVE-2026-68491.md)
  `CVE-2026-68491` · CVE record: Webpros SolusVM · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Tencent Mass Service Engine in Cluster (MSEC) path traversal](https://agentprime.io/advisories/CVE-2026-89040.md)
  `CVE-2026-89040` · CVE record: Tencent Mass Service Engine in Cluster (MSEC) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Newell Brands DYMO Connect Desktop improper file path validation](https://agentprime.io/advisories/CVE-2026-76796.md)
  `CVE-2026-76796` · CVE record: Newell Brands DYMO Connect Desktop · CVSS 5.1 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Http4s: ResourceService and Webjar Service path escape via percent-encoded separators](https://agentprime.io/advisories/GHSA-crq5-92j2-j7wv.md)
  `GHSA-crq5-92j2-j7wv`, `CVE-2026-69201` · Maven `org.http4s:http4s-server_2.12` and 2 more: affected `<0.23.35`, fixed in `0.23.35` · CVSS 5.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Joomla Extension - j2commerce.com - Arbitrary file read via \`task=download\` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7](https://agentprime.io/advisories/CVE-2026-81568.md)
  `CVE-2026-81568` · CVE record: j2commerce.com J2Store extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory](https://agentprime.io/advisories/CVE-2026-79699.md)
  `CVE-2026-79699` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers](https://agentprime.io/advisories/CVE-2026-79705.md)
  `CVE-2026-79705` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 4.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy](https://agentprime.io/advisories/CVE-2026-91940.md)
  `CVE-2026-91940` · CVE record: unclecode crawl4ai · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Flowise before 3.1.4 Remote Code Execution via SQL Database Chain](https://agentprime.io/advisories/CVE-2026-91934.md)
  `CVE-2026-91934` · CVE record: FlowiseAI Flowise · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme](https://agentprime.io/advisories/CVE-2026-87791.md)
  `CVE-2026-87791` · CVE record: Developers Italia design-scuole-wordpress-theme · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback](https://agentprime.io/advisories/CVE-2026-77179.md)
  `CVE-2026-77179` · CVE record: Docker Docker Sandboxes · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Weights & Biases wandb before 0.29.0 Path Traversal via File Download](https://agentprime.io/advisories/CVE-2026-91771.md)
  `CVE-2026-91771` · CVE record: wandb wandb · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API](https://agentprime.io/advisories/CVE-2026-91751.md)
  `CVE-2026-91751` · CVE record: flextype flextype · CVSS 7.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml.](https://agentprime.io/advisories/CVE-2026-51134.md)
  `CVE-2026-51134` · CVE record · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [DevSpace through 6.3.21 Path Traversal via tar extraction](https://agentprime.io/advisories/CVE-2026-91200.md)
  `CVE-2026-91200` · CVE record: devspace devspace · CVSS 8.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-84534.md)
  `CVE-2026-84534` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-64756.md)
  `CVE-2026-64756` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-43691.md)
  `CVE-2026-43691` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-86902.md)
  `CVE-2026-86902` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-84568.md)
  `CVE-2026-84568` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-65382.md)
  `CVE-2026-65382` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Symlink following in Apple macOS](https://agentprime.io/advisories/CVE-2026-84584.md)
  `CVE-2026-84584` · CVE record: Apple macOS · CVSS 8.4 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-43791.md)
  `CVE-2026-43791` · CVE record: Apple macOS · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86886.md)
  `CVE-2026-86886` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-64790.md)
  `CVE-2026-64790` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-84598.md)
  `CVE-2026-84598` · CVE record: Apple iOS and iPadOS · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-84541.md)
  `CVE-2026-84541` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65411.md)
  `CVE-2026-65411` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-86910.md)
  `CVE-2026-86910` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-84624.md)
  `CVE-2026-84624` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths](https://agentprime.io/advisories/CVE-2026-15955.md)
  `CVE-2026-15955` · CVE record: IBM Db2 · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-16335.md)
  `CVE-2026-16335` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-16338.md)
  `CVE-2026-16338` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [tarfile extraction filters allow file modification and content disclosure via hard link to symlink](https://agentprime.io/advisories/CVE-2026-82049.md)
  `CVE-2026-82049` · CVE record: Python Software Foundation CPython · CVSS 8.4 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch](https://agentprime.io/advisories/CVE-2026-82035.md)
  `CVE-2026-82035` · CVE record: PyMuPDF PyMuPDF · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.](https://agentprime.io/advisories/CVE-2026-18515.md)
  `CVE-2026-18515` · CVE record: IBM i · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA5LTE0VDE4OjI2OjU5Ljc1NjAwMFoiLCJDVkUtMjAyNi0xODUxNSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTA5LTE2VDIwOjMzOjAxLjEwNjAwMFoiLCJDVkUtMjAyNi05MjgxNiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTA5LTE2VDIwOjMzOjAxLjEwNjAwMFoiLCJDVkUtMjAyNi05MjgxNiJd>. Everything for agents: <https://agentprime.io/llms.txt>.