# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header](https://agentprime.io/advisories/CVE-2026-88899.md)
  `CVE-2026-88899` · CVE record: knowns-dev knowns · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-81789.md)
  `CVE-2026-81789` · CVE record: Studio Wombat Advanced Product Fields Extended for WooCommerce · CVSS 8.6 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability](https://agentprime.io/advisories/CVE-2026-81275.md)
  `CVE-2026-81275` · CVE record: Youzify Youzify · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability](https://agentprime.io/advisories/CVE-2026-85310.md)
  `CVE-2026-85310` · CVE record: Adrian Tobey Groundhogg · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal](https://agentprime.io/advisories/CVE-2026-88790.md)
  `CVE-2026-88790` · CVE record: proma-ai Proma · CVSS 2.4 Low · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [ICEcoder through 8.1 Path Traversal via oldFileName Parameter](https://agentprime.io/advisories/CVE-2026-64838.md)
  `CVE-2026-64838` · CVE record: ICEcoder ICEcoder · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement](https://agentprime.io/advisories/CVE-2026-64836.md)
  `CVE-2026-64836` · CVE record: ICEcoder ICEcoder · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal, CWE-697
- [LFI in GIS Informatics' GisLab Laboratory Management System](https://agentprime.io/advisories/CVE-2026-9166.md)
  `CVE-2026-9166` · CVE record: GIS Informatics GisLab Laboratory Management System · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4](https://agentprime.io/advisories/CVE-2026-78085.md)
  `CVE-2026-78085` · CVE record: joomshaper.com SP Property extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown](https://agentprime.io/advisories/CVE-2026-88265.md)
  `CVE-2026-88265` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 5.6 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs](https://agentprime.io/advisories/CVE-2026-88264.md)
  `CVE-2026-88264` · CVE record: containers crun and 4 more · CVSS 5.6 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink Creation](https://agentprime.io/advisories/CVE-2026-88288.md)
  `CVE-2026-88288` · CVE record: GeoVision Inc. GV-LPC2011/LPC2211 · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Apache FreeMarker template loading mechanism vulnerable to path traversal](https://agentprime.io/advisories/GHSA-27j2-h3m2-8237.md)
  `GHSA-27j2-h3m2-8237`, `CVE-2026-84939` · Maven `org.freemarker:freemarker`: affected `>=2.2.0, <2.3.35`, fixed in `2.3.35` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment](https://agentprime.io/advisories/CVE-2026-15019.md)
  `CVE-2026-15019` · CVE record: kamalyon Direct Download for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter](https://agentprime.io/advisories/CVE-2026-18386.md)
  `CVE-2026-18386` · CVE record: cssimmon WP BackItUp Community Edition · CVSS 4.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.](https://agentprime.io/advisories/CVE-2025-57231.md)
  `CVE-2025-57231` · CVE record · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [@openhop/server: Path Traversal in Flow ID File Operations](https://agentprime.io/advisories/GHSA-g72f-jw3w-mgh7.md)
  `GHSA-g72f-jw3w-mgh7`, `CVE-2026-59179` · npm `@openhop/server`: affected `<0.3.6`, fixed in `0.3.6` · CVSS 8.3 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis](https://agentprime.io/advisories/CVE-2026-88069.md)
  `CVE-2026-88069` · CVE record: pandora-analysis pandora · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Path Traversal in Fortra's GoAnywhere MFT Endpoint](https://agentprime.io/advisories/CVE-2026-15913.md)
  `CVE-2026-15913` · CVE record: Fortra GoAnywhere MFT · CVSS 7.7 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server](https://agentprime.io/advisories/GHSA-hr3m-4qwq-3mgc.md)
  `GHSA-hr3m-4qwq-3mgc`, `CVE-2026-50024`, `PYSEC-2026-3835` · PyPI `githacker`: affected `<1.1.8`, fixed in `1.1.8` · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint](https://agentprime.io/advisories/GHSA-c23q-fw86-9h5x.md)
  `GHSA-c23q-fw86-9h5x`, `CVE-2025-58363`, `GO-2026-6445` · Go `github.com/lf-edge/ekuiper/v2`: affected `<2.4.1`, fixed in `2.4.1` · CVSS 5.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [knowns before 0.30.0 Path Traversal via Document API](https://agentprime.io/advisories/CVE-2026-86775.md)
  `CVE-2026-86775` · CVE record: knowns-dev knowns · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown](https://agentprime.io/advisories/CVE-2026-86751.md)
  `CVE-2026-86751` · CVE record: grokability snipe-it · CVSS 8.4 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA](https://agentprime.io/advisories/CVE-2026-86741.md)
  `CVE-2026-86741` · CVE record: grokability snipe-it · CVSS 8.4 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Chainlit through 2.12.0 Path Traversal via socket.io sessionId](https://agentprime.io/advisories/CVE-2026-86099.md)
  `CVE-2026-86099` · CVE record: Chainlit chainlit · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Path traversal in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79728.md)
  `CVE-2026-79728` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [External control of a file path in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79692.md)
  `CVE-2026-79692` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.3 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Path traversal in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-78485.md)
  `CVE-2026-78485` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.3 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [SiYuan before v3.8.2 Path Traversal via removeRiffDeck](https://agentprime.io/advisories/CVE-2026-87815.md)
  `CVE-2026-87815` · CVE record: siyuan-note siyuan · CVSS 8.4 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup](https://agentprime.io/advisories/CVE-2026-87766.md)
  `CVE-2026-87766` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters](https://agentprime.io/advisories/CVE-2026-19729.md)
  `CVE-2026-19729` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Ragic｜Enterprise Cloud Database - Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-87747.md)
  `CVE-2026-87747` · CVE record: Ragic Enterprise Cloud Database · CVSS 6.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Path traversal in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2026-21103.md)
  `CVE-2026-21103` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Path traversal in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2026-21092.md)
  `CVE-2026-21092` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Tanium addressed a path traversal vulnerability in Comply.](https://agentprime.io/advisories/CVE-2026-87023.md)
  `CVE-2026-87023` · CVE record: Tanium Comply · CVSS 8.5 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Tanium addressed a path traversal vulnerability in Comply.](https://agentprime.io/advisories/CVE-2026-87030.md)
  `CVE-2026-87030` · CVE record: Tanium Comply · CVSS 8.5 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Tanium addressed a path traversal vulnerability in Tanium Data Service.](https://agentprime.io/advisories/CVE-2026-14505.md)
  `CVE-2026-14505` · CVE record: Tanium Tanium Data Service · CVSS 6.6 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [ntp: write path traversal](https://agentprime.io/advisories/CVE-2026-53581.md)
  `CVE-2026-53581` · CVE record: opnsense core · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [OpenAPI3 version value escapes \`emitterOutputDir\` and overwrites YAML/JSON outside the output tree](https://agentprime.io/advisories/GHSA-2q42-4q24-7rgv.md)
  `GHSA-2q42-4q24-7rgv` · npm `@typespec/compiler` and 1 more: affected `<=1.15.0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Hono: Incomplete fix for CVE-2026-39408: \`toSSG()\` still writes files outside the output directory](https://agentprime.io/advisories/GHSA-gqvv-2mrq-wpjv.md)
  `GHSA-gqvv-2mrq-wpjv`, `CVE-2026-84365` · npm `hono`: affected `<4.13.5`, fixed in `4.13.5` · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature](https://agentprime.io/advisories/GHSA-8m3c-c648-2xjj.md)
  `GHSA-8m3c-c648-2xjj`, `CVE-2026-92595` · npm `nodemailer`: affected `<9.1.1`, fixed in `9.1.1` · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [Next.js: Unauthenticated Remote Code Execution on windows-hosted servers](https://agentprime.io/advisories/GHSA-p293-qw3h-jr36.md)
  `GHSA-p293-qw3h-jr36`, `CVE-2026-75604` · npm `next`: affected `>=13.4.0, <15.5.24 || >=16.0.0, <16.3.3`, fixed in `15.5.24`, `16.3.3` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock](https://agentprime.io/advisories/GHSA-82fw-gwwq-j7x9.md)
  `GHSA-82fw-gwwq-j7x9`, `CVE-2026-84373` · npm `vitest` and 1 more: affected `>=2.1.0, <4.1.11 || >=5.0.0-beta.1, <5.0.0-rc.2`, fixed in `4.1.11`, `5.0.0-rc.2` · CVSS 5.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path](https://agentprime.io/advisories/GHSA-c7r6-vx3h-w5g2.md)
  `GHSA-c7r6-vx3h-w5g2`, `CVE-2026-84374`, `PKSA-xgss-dh88-nswy` · Packagist `maatwebsite/excel`: affected `>=3.1.8, <3.1.70`, fixed in `3.1.70` · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal](https://agentprime.io/advisories/CVE-2026-78622.md)
  `CVE-2026-78622` · CVE record: Okta Okta Verify for Windows · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling](https://agentprime.io/advisories/CVE-2026-78620.md)
  `CVE-2026-78620` · CVE record: Okta Okta Access Gateway · CVSS 5.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Improper Path Validation in Okta Access Gateway Backup and Restore Functionality](https://agentprime.io/advisories/CVE-2026-78624.md)
  `CVE-2026-78624` · CVE record: Okta Okta Access Gateway · CVSS 4.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)](https://agentprime.io/advisories/GHSA-3wxw-xv34-2frg.md)
  `GHSA-3wxw-xv34-2frg`, `CVE-2026-78679`, `PYSEC-2026-3837` · PyPI `gitpython`: affected `<3.1.59`, fixed in `3.1.59` · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, Command injection, Information disclosure
- [GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination](https://agentprime.io/advisories/GHSA-8mcc-hrx5-hvxc.md)
  `GHSA-8mcc-hrx5-hvxc`, `CVE-2026-78677`, `PYSEC-2026-3787` · PyPI `gitpython`: affected `<3.1.59`, fixed in `3.1.59` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [GitPython: Arbitrary local file content disclosure via \[include\] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)](https://agentprime.io/advisories/GHSA-7833-fr7j-v32q.md)
  `GHSA-7833-fr7j-v32q`, `CVE-2026-78675`, `PYSEC-2026-3785` · PyPI `gitpython`: affected `<3.1.59`, fixed in `3.1.59` · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, Information disclosure
- [Skype for Business Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-66302.md)
  `CVE-2026-66302` · CVE record: Microsoft Skype for Business Server 2015 CU13 and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Infracost: Arbitrary file read via config-template readFile symlink traversal](https://agentprime.io/advisories/GHSA-mmg6-4qmv-6pc8.md)
  `GHSA-mmg6-4qmv-6pc8`, `CVE-2026-71493`, `GO-2026-6439` · Go `github.com/infracost/infracost`: affected `<0.10.45`, fixed in `0.10.45` · CVSS 5.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2026-77110.md)
  `CVE-2026-77110` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 7.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Photoshop Mobile | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2026-79904.md)
  `CVE-2026-79904` · CVE record: Adobe Photoshop Android · CVSS 5.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Microsoft Word Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-62804.md)
  `CVE-2026-62804` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 1 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Windows Update Stack Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-81963.md)
  `CVE-2026-81963` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, Broken access control
- [Microsoft Power Automate Desktop Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-77897.md)
  `CVE-2026-77897` · CVE record: Microsoft Power Automate agent for virtual desktops and 1 more · CVSS 7.0 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [.NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69805.md)
  `CVE-2026-69805` · CVE record: Microsoft Microsoft Visual Studio 2022 version 17.14 and 2 more · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, Information disclosure, Hard-coded credentials
- [Microsoft Windows Search Component Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-68896.md)
  `CVE-2026-68896` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [PowerShell Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69807.md)
  `CVE-2026-69807` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.0 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA5LTA4VDE3OjE2OjQzLjA2MjAwMFoiLCJDVkUtMjAyNi02OTgwNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTA5LTEwVDE1OjI4OjUyLjUwNzAwMFoiLCJDVkUtMjAyNi04ODkzNyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTA5LTEwVDE1OjI4OjUyLjUwNzAwMFoiLCJDVkUtMjAyNi04ODkzNyJd>. Everything for agents: <https://agentprime.io/llms.txt>.