# Path traversal. File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [06ketan slideshot renderer.ts render_slides path traversal](https://agentprime.io/advisories/CVE-2026-94049.md) `CVE-2026-94049` · CVE record: 06ketan slideshot · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Path traversal - [0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal](https://agentprime.io/advisories/CVE-2026-94046.md) `CVE-2026-94046` · CVE record: 0215AndrewFeng ACE-MCP · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Path traversal - [03-lovepreetSingh MCP route.ts create_file path traversal](https://agentprime.io/advisories/CVE-2026-94044.md) `CVE-2026-94044` · CVE record: 03-lovepreetSingh MCP · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Path traversal - [00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal](https://agentprime.io/advisories/CVE-2026-94037.md) `CVE-2026-94037` · CVE record: 00Kisumi00 mcp-file-analyzer · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Path traversal - [Arbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine Restoration](https://agentprime.io/advisories/CVE-2026-92253.md) `CVE-2026-92253` · CVE record: WatchDog Anti-Virus · CVSS 5.2 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Path traversal - [Code injection in Vanderbilt University REDCap](https://agentprime.io/advisories/CVE-2026-90817.md) `CVE-2026-90817` · CVE record: Vanderbilt University REDCap · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Sept 2026 · Tags: Path traversal, Code injection - [Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal](https://agentprime.io/advisories/CVE-2026-93992.md) `CVE-2026-93992` · CVE record: GopeedLab gopeed · CVSS 7.0 High · Not analysed yet · Published 19 Sept 2026 · Tags: Path traversal - [QloApps through 1.7.0 Arbitrary File Read via getEmailHTML](https://agentprime.io/advisories/CVE-2026-93988.md) `CVE-2026-93988` · CVE record: webkul qloapps · CVSS 7.1 High · Not analysed yet · Published 19 Sept 2026 · Tags: Path traversal - [rclone serve docker Path Traversal via Volume Name](https://agentprime.io/advisories/CVE-2026-93987.md) `CVE-2026-93987` · CVE record: rclone rclone · CVSS 4.6 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Path traversal - [rclone before 1.75.1 Path Traversal via Directory Listing Names](https://agentprime.io/advisories/CVE-2026-93986.md) `CVE-2026-93986` · CVE record: rclone rclone · CVSS 2.3 Low · Not analysed yet · Published 19 Sept 2026 · Tags: Path traversal - [JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback](https://agentprime.io/advisories/CVE-2026-19860.md) `CVE-2026-19860` · CVE record: Unknown JetFormBuilder — Dynamic Blocks Form Builder · CVSS 5.5 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Path traversal - [Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation](https://agentprime.io/advisories/CVE-2026-85272.md) `CVE-2026-85272` · CVE record: openedx openedx-platform · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84086.md) `CVE-2026-84086` · CVE record: IBM Guardium Data Protection · CVSS 7.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-82896.md) `CVE-2026-82896` · CVE record: IBM Guardium Data Protection · CVSS 7.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet](https://agentprime.io/advisories/CVE-2017-20284.md) `CVE-2017-20284` · CVE record: Caucho Technology, Inc. Resin · CVSS 8.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [Perses's unvalidated project parameter enables filesystem path traversal](https://agentprime.io/advisories/GHSA-vr5f-w35q-98jp.md) `GHSA-vr5f-w35q-98jp`, `CVE-2026-63445`, `GO-2026-6528` · Go `github.com/perses/perses`: affected `<0.54.0-rc.0`, fixed in `0.54.0-rc.0` · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory](https://agentprime.io/advisories/CVE-2026-62278.md) `CVE-2026-62278` · CVE record: hargata lubelog · CVSS 8.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [IBM Cloud Pak for Data is vulnerable to path traversal](https://agentprime.io/advisories/CVE-2025-14753.md) `CVE-2025-14753` · CVE record: IBM Cloud Pak for Data · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).](https://agentprime.io/advisories/CVE-2026-21822.md) `CVE-2026-21822` · CVE record: HCL Software HCL AppScan 360° · CVSS 6.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [Path traversal in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-40535.md) `CVE-2026-40535` · CVE record: Synology DiskStation Manager (DSM) · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [Path traversal in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-40536.md) `CVE-2026-40536` · CVE record: Synology DiskStation Manager (DSM) · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [External control of a file path in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-6205.md) `CVE-2026-6205` · CVE record: Synology DiskStation Manager (DSM) · CVSS 8.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter](https://agentprime.io/advisories/CVE-2026-16777.md) `CVE-2026-16777` · CVE record: jkohlbach Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers · CVSS 4.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters](https://agentprime.io/advisories/CVE-2026-14323.md) `CVE-2026-14323` · CVE record: printcart Printcart Store – Web to Print Product Designer for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [HGiga｜OAKlouds - Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-93468.md) `CVE-2026-93468` · CVE record: HGiga OAKlouds-bulletin_v3-2.0 and 1 more · CVSS 8.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal - [Azure Logic Apps Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70200.md) `CVE-2026-70200` · CVE record: Microsoft Azure Logic Apps · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Broken access control - [Azure Arc Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70009.md) `CVE-2026-70009` · CVE record: Microsoft Azure ARC · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory](https://agentprime.io/advisories/CVE-2026-54520.md) `CVE-2026-54520` · CVE record: vmDeshpande ai-agent-automation · CVSS 8.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [WeGIA: Unauthenticated Auth Bypass + Local File Inclusion](https://agentprime.io/advisories/CVE-2026-54670.md) `CVE-2026-54670` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Authentication bypass - [Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global](https://agentprime.io/advisories/CVE-2026-54612.md) `CVE-2026-54612` · CVE record: givanz Vvveb · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Code injection - [Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter](https://agentprime.io/advisories/CVE-2026-54613.md) `CVE-2026-54613` · CVE record: givanz Vvveb · CVSS 5.4 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing](https://agentprime.io/advisories/CVE-2026-53554.md) `CVE-2026-53554` · CVE record: dataease SQLBot · CVSS 7.3 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Frappe LMS: Path Traversal in SCORM File Serving](https://agentprime.io/advisories/CVE-2026-54343.md) `CVE-2026-54343` · CVE record: frappe lms · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [CVE-2026-15815 CVE Record](https://agentprime.io/advisories/CVE-2026-15815.md) `CVE-2026-15815` · CVE record: Grafana Grafana OSS and 1 more · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Code injection - [Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in \`plugin-asset-map.php\` Static Asset Server (\`index.php\`)](https://agentprime.io/advisories/GHSA-4v9q-p283-qc2m.md) `GHSA-4v9q-p283-qc2m`, `CVE-2026-74907`, `PKSA-t3gq-ss3y-p7b7` · Packagist `getgrav/grav`: affected `<2.0.15`, fixed in `2.0.15` · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion](https://agentprime.io/advisories/GHSA-jq29-c7v8-rg55.md) `GHSA-jq29-c7v8-rg55`, `CVE-2026-72695`, `PKSA-275t-x9d8-k5s3` · Packagist `getgrav/grav`: affected `<2.0.16`, fixed in `2.0.16` · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content](https://agentprime.io/advisories/GHSA-47ch-6w46-6xm7.md) `GHSA-47ch-6w46-6xm7`, `CVE-2026-72697`, `PKSA-9871-4yy4-mgt8` · Packagist `getgrav/grav`: affected `<2.0.16`, fixed in `2.0.16` · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Chamilo LMS CStudio upload flow allows unauthenticated remote code execution](https://agentprime.io/advisories/GHSA-g4c3-4g96-6g4m.md) `GHSA-g4c3-4g96-6g4m`, `CVE-2026-45140`, `PKSA-m8ms-hgzz-8ddw` · Packagist `chamilo/chamilo-lms`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Code injection, Unrestricted file upload, CWE-219 - [Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity](https://agentprime.io/advisories/CVE-2026-89038.md) `CVE-2026-89038` · CVE record: Verizon Verizon Cloud for Android · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images](https://agentprime.io/advisories/GHSA-w3f4-8pj2-599w.md) `GHSA-w3f4-8pj2-599w`, `CVE-2026-69089`, `PKSA-89qq-5khy-n4c4` · Packagist `getgrav/grav`: affected `>=2.0.10, <2.0.11`, fixed in `2.0.11` · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)](https://agentprime.io/advisories/GHSA-m37j-52j7-pjw7.md) `GHSA-m37j-52j7-pjw7`, `CVE-2026-85731`, `GO-2026-6499` · Go `oras.land/oras-go/v2`: affected `<2.6.2`, fixed in `2.6.2` · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults](https://agentprime.io/advisories/CVE-2026-54053.md) `CVE-2026-54053` · CVE record: brufdev many-notes · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [mport package installation has symlink TOCTOU in chown and chmod handling](https://agentprime.io/advisories/CVE-2026-54576.md) `CVE-2026-54576` · CVE record: MidnightBSD mport · CVSS 5.8 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Race condition - [mport directory asset installation is vulnerable to symlink and path traversal races](https://agentprime.io/advisories/CVE-2026-54587.md) `CVE-2026-54587` · CVE record: MidnightBSD mport · CVSS 5.8 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Race condition - [mport sample file handling can write outside the configured root](https://agentprime.io/advisories/CVE-2026-54585.md) `CVE-2026-54585` · CVE record: MidnightBSD mport · CVSS 6.0 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [mport package installation can overwrite existing unmanaged or differently owned files](https://agentprime.io/advisories/CVE-2026-54582.md) `CVE-2026-54582` · CVE record: MidnightBSD mport · CVSS 6.0 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Information disclosure - [mport package bundle downloads allow unsafe destination filenames](https://agentprime.io/advisories/CVE-2026-54583.md) `CVE-2026-54583` · CVE record: MidnightBSD mport · CVSS 8.3 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root](https://agentprime.io/advisories/GHSA-89m4-43j5-vhhx.md) `GHSA-89m4-43j5-vhhx`, `CVE-2026-86071` · Maven `com.github.junrar:junrar`: affected `<7.6.1`, fixed in `7.6.1` · CVSS 3.7 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted](https://agentprime.io/advisories/GHSA-8mvv-mcc3-xwhh.md) `GHSA-8mvv-mcc3-xwhh` · npm `vm2`: affected `<=3.11.6`, no fixed version yet · CVSS 4.2 Medium · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool](https://agentprime.io/advisories/CVE-2026-86864.md) `CVE-2026-86864` · CVE record: pgadmin.org pgAdmin 4 · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Command injection - [pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check](https://agentprime.io/advisories/CVE-2026-86861.md) `CVE-2026-86861` · CVE record: pgadmin.org pgAdmin 4 · CVSS 6.0 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Race condition - [RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter](https://agentprime.io/advisories/CVE-2026-93014.md) `CVE-2026-93014` · CVE record: RosarioSIS RosarioSIS · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal](https://agentprime.io/advisories/CVE-2026-93013.md) `CVE-2026-93013` · CVE record: infiniflow ragflow · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Redocly CLI: Path traversal when using \`split\` command](https://agentprime.io/advisories/GHSA-657c-g7qc-r9j2.md) `GHSA-657c-g7qc-r9j2`, `CVE-2026-63225` · npm `@redocly/cli`: affected `<1.34.17 || >=2.0.0, <2.33.2`, fixed in `1.34.17`, `2.33.2` · CVSS 4.4 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Path traversal in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others](https://agentprime.io/advisories/CVE-2026-81453.md) `CVE-2026-81453` · CVE record: Dell OpenManage Server Administrator Managed Node (Patch) for Windows and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver](https://agentprime.io/advisories/CVE-2026-81829.md) `CVE-2026-81829` · CVE record: Red Hat Red Hat build of Quarkus 3.27.5.SP2 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [HUBzero CMS through 2.2.32 Path Traversal via File Upload](https://agentprime.io/advisories/CVE-2026-92970.md) `CVE-2026-92970` · CVE record: hubzero hubzero-cms · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename](https://agentprime.io/advisories/CVE-2026-92919.md) `CVE-2026-92919` · CVE record: cjbi admin3 · CVSS 7.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Path traversal in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others](https://agentprime.io/advisories/CVE-2026-81481.md) `CVE-2026-81481` · CVE record: Dell OpenManage Server Administrator Managed Node (Patch) for Windows and 4 more · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [ComfyUI before 0.30.0 Path Traversal via dataset save nodes](https://agentprime.io/advisories/CVE-2026-92816.md) `CVE-2026-92816` · CVE record: Comfy-Org ComfyUI · CVSS 8.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .