# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29](https://agentprime.io/advisories/CVE-2026-97161.md)
  `CVE-2026-97161` · CVE record: lomart.fr UP plugin for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal, Broken access control
- [Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29](https://agentprime.io/advisories/CVE-2026-97163.md)
  `CVE-2026-97163` · CVE record: lomart.fr UP plugin for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal, Broken access control
- [Froxlor before 2.3.12 Privilege Escalation via Symlink](https://agentprime.io/advisories/CVE-2026-100716.md)
  `CVE-2026-100716` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Froxlor before 2.3.12 Arbitrary File Deletion via Symlink](https://agentprime.io/advisories/CVE-2026-100715.md)
  `CVE-2026-100715` · CVE record: froxlor froxlor · CVSS 8.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path](https://agentprime.io/advisories/CVE-2026-100707.md)
  `CVE-2026-100707` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots](https://agentprime.io/advisories/CVE-2026-100692.md)
  `CVE-2026-100692` · CVE record: gohugoio hugo · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks](https://agentprime.io/advisories/CVE-2026-100690.md)
  `CVE-2026-100690` · CVE record: gohugoio hugo · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink](https://agentprime.io/advisories/CVE-2026-100682.md)
  `CVE-2026-100682` · CVE record: budibase server · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [SiYuan before v3.8.4 Path Traversal via setNotebookIcon](https://agentprime.io/advisories/CVE-2026-100638.md)
  `CVE-2026-100638` · CVE record: siyuan-note siyuan · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID](https://agentprime.io/advisories/CVE-2026-100637.md)
  `CVE-2026-100637` · CVE record: siyuan-note siyuan · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder](https://agentprime.io/advisories/CVE-2026-100636.md)
  `CVE-2026-100636` · CVE record: siyuan-note siyuan · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames](https://agentprime.io/advisories/CVE-2026-100549.md)
  `CVE-2026-100549` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [OpenClaw before 2026.8.1 Path Traversal via Structured Attachments](https://agentprime.io/advisories/CVE-2026-100536.md)
  `CVE-2026-100536` · CVE record: OpenClaw OpenClaw · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback](https://agentprime.io/advisories/CVE-2026-100533.md)
  `CVE-2026-100533` · CVE record: OpenClaw OpenClaw · CVSS 6.0 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint](https://agentprime.io/advisories/CVE-2026-100520.md)
  `CVE-2026-100520` · CVE record: crivion Laranode · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink](https://agentprime.io/advisories/CVE-2026-100419.md)
  `CVE-2026-100419` · CVE record: GitoxideLabs gitoxide · CVSS 7.3 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem](https://agentprime.io/advisories/GHSA-62mm-xwmv-crhg.md)
  `GHSA-62mm-xwmv-crhg` · PyPI `khoj`: affected `>=2.0.0-beta.23, <2.0.0-beta.25`, fixed in `2.0.0-beta.25` · CVSS 4.0, no score published · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php](https://agentprime.io/advisories/CVE-2026-100372.md)
  `CVE-2026-100372` · CVE record: MacWarrior clipbucket-v5 · CVSS 8.6 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools](https://agentprime.io/advisories/GHSA-9gfj-28hw-jchp.md)
  `GHSA-9gfj-28hw-jchp`, `CVE-2026-86439` · npm `knowns`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, Authentication bypass, Broken access control
- [GLPI: RCE via Form import](https://agentprime.io/advisories/CVE-2026-48482.md)
  `CVE-2026-48482` · CVE record: glpi-project glpi · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [GLPI: arbitrary file deletion](https://agentprime.io/advisories/CVE-2026-47679.md)
  `CVE-2026-47679` · CVE record: glpi-project glpi · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset](https://agentprime.io/advisories/CVE-2026-63006.md)
  `CVE-2026-63006` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller](https://agentprime.io/advisories/CVE-2026-61525.md)
  `CVE-2026-61525` · CVE record: zammad zammad · CVSS 8.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [InvoicePlane: Missing CSRF Protection on State-Changing delete Actions](https://agentprime.io/advisories/CVE-2026-49850.md)
  `CVE-2026-49850` · CVE record: InvoicePlane InvoicePlane · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, File inclusion
- [InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier](https://agentprime.io/advisories/CVE-2026-50547.md)
  `CVE-2026-50547` · CVE record: InvoicePlane InvoicePlane · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, File inclusion
- [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84882.md)
  `CVE-2026-84882` · CVE record: IBM Guardium Data Protection · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request](https://agentprime.io/advisories/CVE-2026-93643.md)
  `CVE-2026-93643` · CVE record: Zimbra Zimbra Collaboration Suite (ZCS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, Broken access control
- [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-85029.md)
  `CVE-2026-85029` · CVE record: IBM Guardium Data Protection · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory](https://agentprime.io/advisories/CVE-2026-80430.md)
  `CVE-2026-80430` · CVE record: Kovid Goyal kitty · CVSS 4.6 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter](https://agentprime.io/advisories/CVE-2026-17602.md)
  `CVE-2026-17602` · CVE record: sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects · CVSS 4.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter](https://agentprime.io/advisories/CVE-2026-78394.md)
  `CVE-2026-78394` · CVE record: Unknown Link Library · CVSS 4.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Path traversal in Netgate pfSense Plus and others](https://agentprime.io/advisories/CVE-2026-97730.md)
  `CVE-2026-97730` · CVE record: Netgate pfSense Plus and 1 more · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers](https://agentprime.io/advisories/CVE-2026-93353.md)
  `CVE-2026-93353` · CVE record: 9001 copyparty · CVSS 2.3 Low · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal, CWE-424
- [Botslab G980H Dashcams Improper Limitation of a Pathname to a Restricted Directory](https://agentprime.io/advisories/CVE-2026-82708.md)
  `CVE-2026-82708` · CVE record: Botslab G980H · CVSS 7.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [chonkie-inc littrs lib.rs mount path traversal](https://agentprime.io/advisories/CVE-2026-97365.md)
  `CVE-2026-97365` · CVE record: chonkie-inc littrs · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)](https://agentprime.io/advisories/GHSA-r4vp-3vw6-r2x5.md)
  `GHSA-r4vp-3vw6-r2x5`, `CVE-2026-57171`, `PYSEC-2026-4030` · PyPI `compliance-trestle`: affected `<3.12.4 || >=4.0.0, <4.1.0`, fixed in `3.12.4`, `4.1.0` · CVSS 7.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs](https://agentprime.io/advisories/GHSA-g28h-2cmm-rj9x.md)
  `GHSA-g28h-2cmm-rj9x` · PyPI `langchain-nvidia-ai-endpoints`: affected `<1.4.2`, fixed in `1.4.2` · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal](https://agentprime.io/advisories/CVE-2026-97323.md)
  `CVE-2026-97323` · CVE record: YunaiV ruoyi-vue-pro and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [Docmost: Public image fileName path traversal leads to unauthorized local file read](https://agentprime.io/advisories/CVE-2026-48072.md)
  `CVE-2026-48072` · CVE record: docmost docmost · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface](https://agentprime.io/advisories/CVE-2026-13248.md)
  `CVE-2026-13248` · CVE record: Honeywell PD45 Industrial Printer · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal, Command injection, Unrestricted file upload
- [Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion](https://agentprime.io/advisories/CVE-2026-48070.md)
  `CVE-2026-48070` · CVE record: docmost docmost · CVSS 7.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [volotat Anagnorisis page.html start_streaming path traversal](https://agentprime.io/advisories/CVE-2026-97232.md)
  `CVE-2026-97232` · CVE record: volotat Anagnorisis · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [Discourse: Reject literal backslash path separators in iframe src traversal guard](https://agentprime.io/advisories/CVE-2026-91123.md)
  `CVE-2026-91123` · CVE record: discourse discourse · CVSS 7.2 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [DbGate files-style Endpoint files.js fs.readFile path traversal](https://agentprime.io/advisories/CVE-2026-97226.md)
  `CVE-2026-97226` · CVE record: DbGate · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files](https://agentprime.io/advisories/GHSA-vf2x-4v53-pm7v.md)
  `GHSA-vf2x-4v53-pm7v`, `CVE-2026-92164`, `PYSEC-2026-4172` · PyPI `streamlink`: affected `<8.6.0`, fixed in `8.6.0` · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft](https://agentprime.io/advisories/CVE-2026-90959.md)
  `CVE-2026-90959` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 4 more · CVSS 8.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-82094.md)
  `CVE-2026-82094` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 7.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81547.md)
  `CVE-2026-81547` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [IBM ContextForge MCP Gateway is affected by path traversal](https://agentprime.io/advisories/CVE-2026-77825.md)
  `CVE-2026-77825` · CVE record: IBM ContextForge MCP Gateway · CVSS 4.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [Path Traversal in HAVELSAN's Liman MYS](https://agentprime.io/advisories/CVE-2026-19532.md)
  `CVE-2026-19532` · CVE record: HAVELSAN Inc. Liman MYS · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [Path Traversal in DIAEnergie](https://agentprime.io/advisories/CVE-2026-78312.md)
  `CVE-2026-78312` · CVE record: Deltaww DIAEnergie · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter](https://agentprime.io/advisories/CVE-2026-77193.md)
  `CVE-2026-77193` · CVE record: eesywp eesy_ID2WP – Publish InDesign HTML5 · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [PaperCut NG/MF: Remote Code Execution via Scan2Fax](https://agentprime.io/advisories/CVE-2026-82077.md)
  `CVE-2026-82077` · CVE record: PaperCut PaperCut NG/MF · CVSS 7.3 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal, Command injection
- [MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget](https://agentprime.io/advisories/CVE-2026-88843.md)
  `CVE-2026-88843` · CVE record: Unknown MasterStudy LMS WordPress Plugin · CVSS 7.2 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [yhx070424 ShopXO Ueditor Upload ueditor.php path traversal](https://agentprime.io/advisories/CVE-2026-96898.md)
  `CVE-2026-96898` · CVE record: yhx070424 ShopXO · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [MantisZip Preview MainWindow.UI.cs Path.Combine path traversal](https://agentprime.io/advisories/CVE-2026-96884.md)
  `CVE-2026-96884` · CVE record: MantisZip · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal](https://agentprime.io/advisories/CVE-2026-96678.md)
  `CVE-2026-96678` · CVE record: weiqingwen spring-boot-forum · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Path traversal
- [Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler](https://agentprime.io/advisories/CVE-2026-75887.md)
  `CVE-2026-75887` · CVE record: Red Hat Red Hat OpenShift Container Platform 4.12 and 4 more · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Path traversal
- [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-6925.md)
  `CVE-2026-6925` · CVE record: IBM Concert · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Path traversal
- [RabbitMQ: Admin path-traversal write via trace name](https://agentprime.io/advisories/CVE-2026-67224.md)
  `CVE-2026-67224` · CVE record: rabbitmq rabbitmq-server · CVSS 2.1 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA5LTIzVDIwOjA1OjA0LjkyMzAwMFoiLCJDVkUtMjAyNi02NzIyNCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTA5LTI3VDA2OjAwOjE5LjAwODAwMFoiLCJDVkUtMjAyNi04NDA2OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTA5LTI3VDA2OjAwOjE5LjAwODAwMFoiLCJDVkUtMjAyNi04NDA2OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.