# Path traversal. File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.\_\_init\_\_.](https://agentprime.io/advisories/CVE-2026-51853.md) `CVE-2026-51853` · CVE record · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal - [agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64.](https://agentprime.io/advisories/CVE-2026-51852.md) `CVE-2026-51852` · CVE record · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal - [modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.](https://agentprime.io/advisories/CVE-2026-51570.md) `CVE-2026-51570` · CVE record · CVSS 8.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal - [modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.](https://agentprime.io/advisories/CVE-2026-51568.md) `CVE-2026-51568` · CVE record · CVSS 8.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal - [@xhmikosr/decompress: Path traversal via symlink chain](https://agentprime.io/advisories/GHSA-hrh2-vp3x-79xf.md) `GHSA-hrh2-vp3x-79xf`, `CVE-2026-101894` · npm `decompress` and 1 more: affected `<=4.2.1`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read](https://agentprime.io/advisories/CVE-2026-13224.md) `CVE-2026-13224` · CVE record: WatchGuard Fireware OS · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Fireware OS Improper Authorization in Access Portal Reverse Proxy](https://agentprime.io/advisories/CVE-2026-86105.md) `CVE-2026-86105` · CVE record: WatchGuard Fireware OS · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal, Broken access control, CWE-176 - [Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A](https://agentprime.io/advisories/CVE-2026-86136.md) `CVE-2026-86136` · CVE record: WatchGuard Fireware OS · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal, Memory corruption, Broken access control - [EasyTimeline should not serve image maps as application/xml](https://agentprime.io/advisories/CVE-2026-103044.md) `CVE-2026-103044` · CVE record: The Wikimedia Foundation Mediawiki - EasyTimeline extension · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal, Other injection - [VLC media player before 3.0.24 Path Traversal via skins2](https://agentprime.io/advisories/CVE-2026-102875.md) `CVE-2026-102875` · CVE record: videolan vlc · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Path Traversal in VMDK Extractor in OSV-SCALIBR](https://agentprime.io/advisories/CVE-2026-102252.md) `CVE-2026-102252` · CVE record: Google OSV-SCALIBR · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On](https://agentprime.io/advisories/CVE-2026-76737.md) `CVE-2026-76737` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 3.0 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-84421.md) `CVE-2026-84421` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84842.md) `CVE-2026-84842` · CVE record: IBM Guardium Data Protection · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases](https://agentprime.io/advisories/CVE-2026-102242.md) `CVE-2026-102242` · CVE record: Google MCP Toolbox for Databases · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory](https://agentprime.io/advisories/CVE-2026-12345.md) `CVE-2026-12345` · CVE record: Python Software Foundation CPython · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Marmite through 0.4.2 Path Traversal via Development Server](https://agentprime.io/advisories/CVE-2026-102810.md) `CVE-2026-102810` · CVE record: rochacbruno marmite · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-102424.md) `CVE-2026-102424` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 8.9 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-101126.md) `CVE-2026-101126` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath](https://agentprime.io/advisories/GHSA-g84c-rxfj-3j2c.md) `GHSA-g84c-rxfj-3j2c`, `CVE-2026-76844` · npm `webpack-dev-middleware`: affected `<7.4.6 || >=8.0.0, <8.3.0`, fixed in `7.4.6`, `8.3.0` · CVSS 8.3 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal, Memory corruption - [Joomla! Core - \[20260905\] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90915.md) `CVE-2026-90915` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording](https://agentprime.io/advisories/CVE-2026-92371.md) `CVE-2026-92371` · CVE record: TeamViewer Full Client and 1 more · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients](https://agentprime.io/advisories/CVE-2026-19743.md) `CVE-2026-19743` · CVE record: TeamViewer Full Client and 1 more · CVSS 7.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module](https://agentprime.io/advisories/CVE-2026-85520.md) `CVE-2026-85520` · CVE record: MyPresta Google Merchant Center Feed · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark](https://agentprime.io/advisories/CVE-2026-96419.md) `CVE-2026-96419` · CVE record: Wireshark Foundation Wireshark · CVSS 5.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Path traversal in Hitachi Energy RTU500 series CMU firmware](https://agentprime.io/advisories/CVE-2026-8066.md) `CVE-2026-8066` · CVE record: Hitachi Energy RTU500 series CMU firmware · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）](https://agentprime.io/advisories/CVE-2026-96440.md) `CVE-2026-96440` · CVE record: Flowring Technology Corp Agentflow 4.0 · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation](https://agentprime.io/advisories/CVE-2026-91012.md) `CVE-2026-91012` · CVE record: Apache Software Foundation Apache Karaf · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystemserver/handler/helper.go).](https://agentprime.io/advisories/CVE-2026-79534.md) `CVE-2026-79534` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal - [Dozzle before 11.1.2 Path Traversal via Log ZIP Download](https://agentprime.io/advisories/CVE-2026-102332.md) `CVE-2026-102332` · CVE record: amir20 dozzle · CVSS 4.6 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [ZoneMinder 1.37.x Path Traversal via files view](https://agentprime.io/advisories/CVE-2024-58386.md) `CVE-2024-58386` · CVE record: ZoneMinder zoneminder · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal](https://agentprime.io/advisories/CVE-2026-101142.md) `CVE-2026-101142` · CVE record: Eleveo Quality Management · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal](https://agentprime.io/advisories/CVE-2026-101132.md) `CVE-2026-101132` · CVE record: DeepSeek deepseek-harness · CVSS 2.3 Low · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module](https://agentprime.io/advisories/CVE-2026-54708.md) `CVE-2026-54708` · CVE record: FreePBX security-reporting · CVSS 8.6 High · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal, Code injection - [FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module](https://agentprime.io/advisories/CVE-2026-54675.md) `CVE-2026-54675` · CVE record: FreePBX security-reporting · CVSS 8.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal, Unrestricted file upload - [PMWeb downloader.aspx path traversal](https://agentprime.io/advisories/CVE-2026-101082.md) `CVE-2026-101082` · CVE record: PMWeb · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal](https://agentprime.io/advisories/CVE-2026-101080.md) `CVE-2026-101080` · CVE record: Tencent AI-Infra-Guard · CVSS 2.4 Low · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Path Traversal in Innotim Software's Logsign SIEM](https://agentprime.io/advisories/CVE-2026-90925.md) `CVE-2026-90925` · CVE record: Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory](https://agentprime.io/advisories/CVE-2026-93537.md) `CVE-2026-93537` · CVE record: SUSE Rancher · CVSS 6.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [LXD client recursive file pull allows directory escape via malicious VM agent](https://agentprime.io/advisories/CVE-2026-87798.md) `CVE-2026-87798` · CVE record: Canonical LXD · CVSS 5.8 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Arbitrary file write on LXD host via symlink in migration stream](https://agentprime.io/advisories/CVE-2026-87799.md) `CVE-2026-87799` · CVE record: Canonical LXD · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root](https://agentprime.io/advisories/CVE-2026-85185.md) `CVE-2026-85185` · CVE record: Canonical LXD · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Path traversal via Btrfs optimized-backup subvolumes\[\].path enables root file/dir manipulation in LXD](https://agentprime.io/advisories/CVE-2026-85526.md) `CVE-2026-85526` · CVE record: Canonical LXD · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [CLI Path Traversal via Content-Disposition in LXD Image Export/Copy](https://agentprime.io/advisories/CVE-2026-86334.md) `CVE-2026-86334` · CVE record: Canonical LXD · CVSS 4.2 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Path Traversal During Project Archive Import](https://agentprime.io/advisories/CVE-2026-15953.md) `CVE-2026-15953` · CVE record: ABB Protection and control IED manager (PCM600) · CVSS 5.6 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [dbgate Files Endpoint runners.js files path traversal](https://agentprime.io/advisories/CVE-2026-101070.md) `CVE-2026-101070` · CVE record: dbgate · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Path Traversal in Dayforce ESS Excelity](https://agentprime.io/advisories/CVE-2026-73642.md) `CVE-2026-73642` · CVE record: Dayforce ESS Excelity · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [dbgate Export databaseConnections.js exportModelSql path traversal](https://agentprime.io/advisories/CVE-2026-101069.md) `CVE-2026-101069` · CVE record: dbgate · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal](https://agentprime.io/advisories/CVE-2026-101068.md) `CVE-2026-101068` · CVE record: dbgate · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal](https://agentprime.io/advisories/CVE-2026-101067.md) `CVE-2026-101067` · CVE record: dbgate · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [dbgate Archive Link Creation archive.js createLink path traversal](https://agentprime.io/advisories/CVE-2026-101066.md) `CVE-2026-101066` · CVE record: dbgate · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes](https://agentprime.io/advisories/CVE-2026-19444.md) `CVE-2026-19444` · CVE record: Kubernetes Kubernetes · CVSS 6.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal](https://agentprime.io/advisories/CVE-2026-101036.md) `CVE-2026-101036` · CVE record: FLB-Music FLB-Music-Player · CVSS 4.8 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Path Traversal in Bimser Solution Software's eBA Plus](https://agentprime.io/advisories/CVE-2026-82915.md) `CVE-2026-82915` · CVE record: Bimser Solution Software Trade Inc. eBA Plus Document and Workflow Management System · CVSS 6.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal - [Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following](https://agentprime.io/advisories/CVE-2026-96284.md) `CVE-2026-96284` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 2.5 Low · Not analysed yet · Published 27 Sept 2026 · Tags: Path traversal - [Flatpak: flatpak: extension metadata path traversal file existence oracle](https://agentprime.io/advisories/CVE-2026-96282.md) `CVE-2026-96282` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 3.1 Low · Not analysed yet · Published 27 Sept 2026 · Tags: Path traversal - [Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks](https://agentprime.io/advisories/CVE-2026-96279.md) `CVE-2026-96279` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Path traversal - [pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias](https://agentprime.io/advisories/CVE-2026-101044.md) `CVE-2026-101044` · CVE record: pnpm pnpm · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2026 · Tags: Path traversal - [Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0](https://agentprime.io/advisories/CVE-2026-97164.md) `CVE-2026-97164` · CVE record: svenbluege.de Event Gallery for Joomla · CVSS 7.0 High · Not analysed yet · Published 27 Sept 2026 · Tags: Path traversal - [WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php](https://agentprime.io/advisories/CVE-2026-84069.md) `CVE-2026-84069` · CVE record: Unknown WebFacing™ · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Path traversal Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .