# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests](https://agentprime.io/advisories/GHSA-6gw6-rv2g-25mg.md)
  `GHSA-6gw6-rv2g-25mg`, `CVE-2026-105795` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `>=1.25.1, <1.35.0`, fixed in `1.35.0` · CVSS 3.1 Low · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()](https://agentprime.io/advisories/CVE-2026-105840.md)
  `CVE-2026-105840` · CVE record: Uwe Ohse lrzsz · CVSS 7.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source](https://agentprime.io/advisories/CVE-2026-105834.md)
  `CVE-2026-105834` · CVE record: rundeck rundeck · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-39792.md)
  `CVE-2026-39792` · CVE record: Mitchell Bennis Simple File List · CVSS 8.6 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability](https://agentprime.io/advisories/CVE-2026-39754.md)
  `CVE-2026-39754` · CVE record: About Piotnet Piotnet Addons For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-39752.md)
  `CVE-2026-39752` · CVE record: BlueGlass Interactive AG Jobs for WordPress · CVSS 7.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java.](https://agentprime.io/advisories/CVE-2026-95140.md)
  `CVE-2026-95140` · CVE record · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [uv: Path traversal on Windows through wheel extraction](https://agentprime.io/advisories/GHSA-2cv4-cqwr-gwf7.md)
  `GHSA-2cv4-cqwr-gwf7`, `CVE-2026-104843`, `PYSEC-2026-4305` · crates.io `uv` and 1 more: affected `>=0.12.7, <0.12.18`, fixed in `0.12.18` · CVSS 5.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Mako: Path traversal via drive-letter URI on Windows in TemplateLookup](https://agentprime.io/advisories/GHSA-5639-2j2p-m4mx.md)
  `GHSA-5639-2j2p-m4mx`, `CVE-2026-102991`, `PYSEC-2026-4243` · PyPI `mako`: affected `<1.4.2`, fixed in `1.4.2` · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Nx: Path traversal in nx migrate package-migrations extraction](https://agentprime.io/advisories/GHSA-hrvq-x7jp-36xv.md)
  `GHSA-hrvq-x7jp-36xv`, `CVE-2026-104853` · npm `nx`: affected `>=13.10.0, <22.7.10 || >=23.0.0, <23.2.1`, fixed in `22.7.10`, `23.2.1` · CVSS 5.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows](https://agentprime.io/advisories/GHSA-7g7c-h8rr-7p6q.md)
  `GHSA-7g7c-h8rr-7p6q`, `CVE-2026-104871` · npm `@angular/ssr`: affected `<=19.2.27 || >=20.0.0, <20.3.36 || >=21.0.0, <21.2.23 || >=22.0.0, <22.1.7`, fixed in `20.3.36`, `21.2.23`, `22.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend](https://agentprime.io/advisories/GHSA-4xhp-xg4w-8ppm.md)
  `GHSA-4xhp-xg4w-8ppm`, `CVE-2026-105751`, `PYSEC-2026-4207` · PyPI `docling`: affected `>=2.107.0, <2.120.3`, fixed in `2.120.3` · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control](https://agentprime.io/advisories/CVE-2026-102262.md)
  `CVE-2026-102262` · CVE record: Newell Brands DYMO ID · CVSS 7.0 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, Information disclosure
- [auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF](https://agentprime.io/advisories/CVE-2026-12171.md)
  `CVE-2026-12171` · CVE record: cookpete auto-changelog · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, Command injection, Code injection, Server-side request forgery (SSRF)
- [Server-side request forgery in Eclipse Foundation Eclipse Che](https://agentprime.io/advisories/CVE-2026-86671.md)
  `CVE-2026-86671` · CVE record: Eclipse Foundation Eclipse Che · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, Hard-coded credentials, Server-side request forgery (SSRF)
- [Arbitrary file read via the convert_playwright_script prompt in mcp-k6](https://agentprime.io/advisories/CVE-2026-89039.md)
  `CVE-2026-89039` · CVE record: Grafana mcp-k6 · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, CWE-424
- [Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality](https://agentprime.io/advisories/CVE-2026-63266.md)
  `CVE-2026-63266` · CVE record: The Document Foundation LibreOffice · CVSS 6.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal](https://agentprime.io/advisories/CVE-2026-105286.md)
  `CVE-2026-105286` · CVE record: Totolink A3002MU · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Arbitrary file-write via extension installation in P4Search](https://agentprime.io/advisories/CVE-2026-103511.md)
  `CVE-2026-103511` · CVE record: Perforce P4 (Helix Core) · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2026-104809.md)
  `CVE-2026-104809` · CVE record: Mitel Mitel MiVoice Office 400 · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, CWE-426, CWE-427, CWE-494
- [Arbitrary file-write via log configuration path in P4Search](https://agentprime.io/advisories/CVE-2026-103507.md)
  `CVE-2026-103507` · CVE record: Perforce P4 (Helix Core) · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution](https://agentprime.io/advisories/CVE-2026-104805.md)
  `CVE-2026-104805` · CVE record: Mitel Mitel MiVoice Office 400 · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, Unrestricted file upload, CWE-345, CWE-494
- [Path traversal in Papermerge](https://agentprime.io/advisories/CVE-2026-105314.md)
  `CVE-2026-105314` · CVE record: Papermerge Papermerge · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers](https://agentprime.io/advisories/CVE-2026-105293.md)
  `CVE-2026-105293` · CVE record: Legcord Legcord · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Gerapy Project Management views.py project_create path traversal](https://agentprime.io/advisories/CVE-2026-105174.md)
  `CVE-2026-105174` · CVE record: Gerapy · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Feehi CMS 2.1.1 is vulnerable to Directory Traversal.](https://agentprime.io/advisories/CVE-2026-95264.md)
  `CVE-2026-95264` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [ApiAdmin v5.0 and before is vulnerable to Directory Traversal.](https://agentprime.io/advisories/CVE-2026-88396.md)
  `CVE-2026-88396` · CVE record · CVSS 7.2 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [WookTeam v1.6.6 and before is vulnerable to a Directory Traversal.](https://agentprime.io/advisories/CVE-2026-88394.md)
  `CVE-2026-88394` · CVE record · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local().](https://agentprime.io/advisories/CVE-2026-88392.md)
  `CVE-2026-88392` · CVE record · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal](https://agentprime.io/advisories/CVE-2026-105157.md)
  `CVE-2026-105157` · CVE record: RainyGao DocSys · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Path traversal
- [Drogon Static File Router StaticFileRouter.cc route path traversal](https://agentprime.io/advisories/CVE-2026-105144.md)
  `CVE-2026-105144` · CVE record: Drogon · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Path traversal
- [LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint](https://agentprime.io/advisories/CVE-2026-105125.md)
  `CVE-2026-105125` · CVE record: laradashboard laradashboard · CVSS 6.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Path traversal
- [Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal](https://agentprime.io/advisories/CVE-2026-104983.md)
  `CVE-2026-104983` · CVE record: Linux Mint Xreader · CVSS 5.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Path traversal
- [Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal](https://agentprime.io/advisories/CVE-2026-104982.md)
  `CVE-2026-104982` · CVE record: Linux Mint Xreader · CVSS 5.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Path traversal
- [VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter](https://agentprime.io/advisories/CVE-2026-87115.md)
  `CVE-2026-87115` · CVE record: e4jvikwp VikAppointments Services Booking Calendar · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2026 · Tags: Path traversal
- [Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter](https://agentprime.io/advisories/CVE-2026-94238.md)
  `CVE-2026-94238` · CVE record: Unknown Loco Translate · CVSS 6.8 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Path traversal
- [Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal](https://agentprime.io/advisories/CVE-2026-85015.md)
  `CVE-2026-85015` · CVE record: Unknown Unlimited Elements for Elementor · CVSS 6.6 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Path traversal
- [MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import](https://agentprime.io/advisories/CVE-2026-103293.md)
  `CVE-2026-103293` · CVE record: Unknown MPG · CVSS 6.8 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Path traversal
- [Formwork before 2.3.13 Path Traversal via BackupController Download and Delete](https://agentprime.io/advisories/CVE-2026-104478.md)
  `CVE-2026-104478` · CVE record: getformwork formwork · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)](https://agentprime.io/advisories/GHSA-p23f-cm6q-2qp8.md)
  `GHSA-p23f-cm6q-2qp8`, `CVE-2026-82233`, `GO-2026-6655` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260813142104-b26a4a307b8a`, fixed in `0.0.0-20260813142104-b26a4a307b8a` · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [Vibe-Trading file-read tools expose arbitrary server-readable files](https://agentprime.io/advisories/GHSA-5rmq-chc7-m22f.md)
  `GHSA-5rmq-chc7-m22f`, `CVE-2026-114106` · PyPI `vibe-trading-ai`: affected `>=0.1.0, <0.1.7`, fixed in `0.1.7` · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal, Information disclosure
- [Path traversal in aquasec Trivy](https://agentprime.io/advisories/CVE-2026-104994.md)
  `CVE-2026-104994` · CVE record: aquasec Trivy · CVSS 2.5 Low · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path](https://agentprime.io/advisories/GHSA-96h3-5x6v-m776.md)
  `GHSA-96h3-5x6v-m776`, `BIT-composer-2026-59944`, `CVE-2026-59944`, `PKSA-ddsx-fjz2-sbs3` · Packagist `composer/composer`: affected `>=1.0, <2.2.30 || >=2.3.0, <2.10.3`, fixed in `2.2.30`, `2.10.3` · CVSS 6.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal, Broken access control
- [Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths](https://agentprime.io/advisories/GHSA-8mcx-5rqc-vhmf.md)
  `GHSA-8mcx-5rqc-vhmf`, `CVE-2026-114094` · PyPI `dulwich`: affected `<1.2.9`, fixed in `1.2.9` · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [Dulwich: Symlink write-through in checkout(paths=\[\]) via raw os.open bypasses all symlink protections](https://agentprime.io/advisories/GHSA-8w8g-wq8h-fq33.md)
  `GHSA-8w8g-wq8h-fq33`, `CVE-2026-114096` · PyPI `dulwich`: affected `>=0.24.0, <1.2.8`, fixed in `1.2.8` · CVSS 7.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal, CWE-61
- [Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence](https://agentprime.io/advisories/GHSA-5fqc-mrg8-w798.md)
  `GHSA-5fqc-mrg8-w798`, `CVE-2026-114097` · PyPI `dulwich`: affected `>=0.23.1, <1.2.8`, fixed in `1.2.8` · CVSS 7.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks](https://agentprime.io/advisories/GHSA-cm62-gvxx-vmxx.md)
  `GHSA-cm62-gvxx-vmxx`, `CVE-2026-114098` · PyPI `dulwich`: affected `>=0.22.5, <1.2.8`, fixed in `1.2.8` · CVSS 7.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php](https://agentprime.io/advisories/CVE-2014-125130.md)
  `CVE-2014-125130` · CVE record: Damjan CodeArt Google MP3 Audio Player · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader](https://agentprime.io/advisories/CVE-2026-103648.md)
  `CVE-2026-103648` · CVE record: demsking image-downloader · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [Logback: Incomplete protection against CVE-2026-19880](https://agentprime.io/advisories/CVE-2026-104721.md)
  `CVE-2026-104721` · CVE record: QOS.CH Sarl Logback-classic · CVSS 6.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by…](https://agentprime.io/advisories/CVE-2026-51907.md)
  `CVE-2026-51907` · CVE record · CVSS 8.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server file…](https://agentprime.io/advisories/CVE-2026-51906.md)
  `CVE-2026-51906` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage_image](https://agentprime.io/advisories/CVE-2025-71427.md)
  `CVE-2025-71427` · CVE record: GongRzhe Office-PowerPoint-MCP-Server · CVSS 7.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [External control of a file path in Johnson Controls EasyIO FS32](https://agentprime.io/advisories/CVE-2026-71453.md)
  `CVE-2026-71453` · CVE record: Johnson Controls EasyIO FS32 · CVSS 5.6 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Local File Inclusion in Teledyne FLIR Robots running Aware2](https://agentprime.io/advisories/CVE-2026-55393.md)
  `CVE-2026-55393` · CVE record: Teledyne FLIR Aware2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field](https://agentprime.io/advisories/CVE-2026-71426.md)
  `CVE-2026-71426` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal, File inclusion
- [Path traversal in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2026-104286.md)
  `CVE-2026-104286` · CVE record: Fortinet FortiMail · CVSS 9.8 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools](https://agentprime.io/advisories/CVE-2026-55231.md)
  `CVE-2026-55231` · CVE record: givanz Vvveb · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace](https://agentprime.io/advisories/CVE-2026-97662.md)
  `CVE-2026-97662` · CVE record: AWS security-agent-mcp-server · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal, Command injection
- [Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read](https://agentprime.io/advisories/CVE-2026-103884.md)
  `CVE-2026-103884` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTEwLTAxVDE3OjE2OjIxLjA5MzAwMFoiLCJDVkUtMjAyNi0xMDM4ODQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTEwLTA2VDE2OjMzOjA2Ljg0OTAwMFoiLCJDVkUtMjAyNi0xMDYyMTkiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTEwLTA2VDE2OjMzOjA2Ljg0OTAwMFoiLCJDVkUtMjAyNi0xMDYyMTkiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.