# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Path Traversal leading to Remote Code Execution in Ollama](https://agentprime.io/advisories/CVE-2026-103663.md)
  `CVE-2026-103663` · CVE record: Ollama Ollama · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, CWE-913
- [Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0](https://agentprime.io/advisories/CVE-2026-102783.md)
  `CVE-2026-102783` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Improper Link Resolution Before File Access ('Link Following') in hMailServer](https://agentprime.io/advisories/CVE-2026-107578.md)
  `CVE-2026-107578` · CVE record: Progressive Robot Ltd hMailServer · CVSS 6.7 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Flatpak-builder: local file exfiltration via \`file](https://agentprime.io/advisories/CVE-2026-107466.md)
  `CVE-2026-107466` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Path traversal in Brocade Active Support Connectivity Gateway](https://agentprime.io/advisories/CVE-2026-85490.md)
  `CVE-2026-85490` · CVE record: Brocade Brocade Active Support Connectivity Gateway · CVSS 7.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Path traversal in Brocade Active Support Connectivity Gateway](https://agentprime.io/advisories/CVE-2026-85487.md)
  `CVE-2026-85487` · CVE record: Brocade Brocade Active Support Connectivity Gateway · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback](https://agentprime.io/advisories/CVE-2026-86828.md)
  `CVE-2026-86828` · CVE record: Unknown BackWPup · CVSS 6.6 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Path traversal in Brocade SANnav](https://agentprime.io/advisories/CVE-2026-5049.md)
  `CVE-2026-5049` · CVE record: Brocade Brocade SANnav · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [External control of a file path in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87685.md)
  `CVE-2026-87685` · CVE record: Brocade Fabric OS · CVSS 8.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Path traversal in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-94580.md)
  `CVE-2026-94580` · CVE record: Brocade Fabric OS · CVSS 5.7 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution](https://agentprime.io/advisories/CVE-2026-105820.md)
  `CVE-2026-105820` · CVE record: HashiCorp Vault Enterprise · CVSS 5.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots](https://agentprime.io/advisories/CVE-2026-105816.md)
  `CVE-2026-105816` · CVE record: HashiCorp Vault and 1 more · CVSS 8.0 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine](https://agentprime.io/advisories/GHSA-x3q2-h9hx-4r4j.md)
  `GHSA-x3q2-h9hx-4r4j`, `CVE-2026-105744`, `PYSEC-2026-4191`, `PYSEC-2026-4216` · PyPI `docling` and 1 more: affected `>=2.94.0, <2.132.0`, fixed in `2.132.0` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, CWE-1188
- [Docling: Crafted DoclingDocument JSON embeds local image files into converted output](https://agentprime.io/advisories/GHSA-p944-4xh2-x776.md)
  `GHSA-p944-4xh2-x776`, `CVE-2026-105748`, `PYSEC-2026-4208`, `PYSEC-2026-4213` · PyPI `docling` and 1 more: affected `>=2.16.0, <2.131.0`, fixed in `2.131.0` · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Information disclosure
- [Payload: Incomplete validation during the upload file lifecycle](https://agentprime.io/advisories/GHSA-p223-2wr2-j562.md)
  `GHSA-p223-2wr2-j562`, `CVE-2026-105865` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Ghost: Path Traversal via Locale Setting](https://agentprime.io/advisories/GHSA-m382-6jw4-fmp6.md)
  `GHSA-m382-6jw4-fmp6`, `BIT-ghost-2026-104417`, `BIT-ghost-2026-105676`, `CVE-2026-104417`, `CVE-2026-105676` · npm `ghost`: affected `>=1.20.0, <6.64.0`, fixed in `6.64.0` · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Ghost: Remote Code Execution via Theme Translation Files](https://agentprime.io/advisories/GHSA-jj74-hc2q-xrvm.md)
  `GHSA-jj74-hc2q-xrvm`, `BIT-ghost-2026-104418`, `BIT-ghost-2026-105677`, `CVE-2026-104418`, `CVE-2026-105677` · npm `ghost`: affected `>=6.10.3, <6.64.0`, fixed in `6.64.0` · CVSS 8.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Code injection, CWE-829
- [Backstage: Improper input validation in Confluence to Markdown scaffolder module](https://agentprime.io/advisories/GHSA-75qf-886x-5xf2.md)
  `GHSA-75qf-886x-5xf2`, `CVE-2026-106559` · npm `@backstage/plugin-scaffolder-backend-module-confluence-to-markdown`: affected `<0.3.25`, fixed in `0.3.25` · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Backstage: Improper repository path validation in a Scaffolder backend module](https://agentprime.io/advisories/GHSA-2cmg-v53w-8xfp.md)
  `GHSA-2cmg-v53w-8xfp`, `CVE-2026-106560` · npm `@backstage/plugin-scaffolder-backend-module-confluence-to-markdown`: affected `<0.3.25`, fixed in `0.3.25` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions](https://agentprime.io/advisories/GHSA-g8rx-f7m5-7794.md)
  `GHSA-g8rx-f7m5-7794`, `CVE-2026-106486` · npm `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` and 1 more: affected `<0.3.10`, fixed in `0.3.10` · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Backstage: Improper authorization enforcement for TechDocs static content](https://agentprime.io/advisories/GHSA-rg9r-hr7g-5gc2.md)
  `GHSA-rg9r-hr7g-5gc2`, `CVE-2026-106489` · npm `@backstage/plugin-techdocs-backend`: affected `<2.2.4`, fixed in `2.2.4` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Broken access control
- [Backstage: Improper input validation in TechDocs static content requests](https://agentprime.io/advisories/GHSA-7mfx-xg57-53c9.md)
  `GHSA-7mfx-xg57-53c9`, `CVE-2026-106490` · npm `@backstage/plugin-techdocs-backend`: affected `<2.2.4`, fixed in `2.2.4` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Backstage: Cloud storage catalog locations may cross configured storage boundaries](https://agentprime.io/advisories/GHSA-xvh9-35w9-42m4.md)
  `GHSA-xvh9-35w9-42m4`, `CVE-2026-106493` · npm `@backstage/backend-defaults` and 2 more: affected `<0.17.8`, fixed in `0.17.8` · CVSS 3.0 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Backstage: Improper input validation in proxy-backend](https://agentprime.io/advisories/GHSA-9ghw-48h5-v2w5.md)
  `GHSA-9ghw-48h5-v2w5`, `CVE-2026-106491` · npm `@backstage/plugin-proxy-backend`: affected `<0.6.17`, fixed in `0.6.17` · CVSS 6.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, CWE-20
- [Backstage: Improper input validation in cloud storage URL readers](https://agentprime.io/advisories/GHSA-7649-wm97-w3j3.md)
  `GHSA-7649-wm97-w3j3`, `CVE-2026-106494` · npm `@backstage/backend-defaults`: affected `<0.17.8`, fixed in `0.17.8` · CVSS 4.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Backstage: Inconsistent enforcement of allowed location types during catalog processing](https://agentprime.io/advisories/GHSA-pcmq-25r3-5w9v.md)
  `GHSA-pcmq-25r3-5w9v`, `CVE-2026-106496` · npm `@backstage/plugin-catalog-backend`: affected `<3.9.1`, fixed in `3.9.1` · CVSS 3.1 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Broken access control
- [Backstage: Improper task state validation in Scaffolder backend](https://agentprime.io/advisories/GHSA-xvgh-hmx8-9xxf.md)
  `GHSA-xvgh-hmx8-9xxf`, `CVE-2026-106500` · npm `@backstage/plugin-scaffolder-backend`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Race condition
- [Backstage has potential file exposure through local TechDocs publisher](https://agentprime.io/advisories/GHSA-cm77-ch27-6w6v.md)
  `GHSA-cm77-ch27-6w6v`, `CVE-2026-106508` · npm `@backstage/plugin-techdocs-node`: affected `<1.15.4`, fixed in `1.15.4` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Backstage has improper input validation in TechDocs Markdown extension configuration](https://agentprime.io/advisories/GHSA-f7v3-xhm6-w245.md)
  `GHSA-f7v3-xhm6-w245`, `CVE-2026-106557` · npm `@backstage/plugin-techdocs-node`: affected `<1.15.4`, fixed in `1.15.4` · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [Ghost: Path Traversal Vulnerability in Ghost ImageSize Service](https://agentprime.io/advisories/GHSA-83rp-q473-j88c.md)
  `GHSA-83rp-q473-j88c`, `BIT-ghost-2026-103290`, `BIT-ghost-2026-105683`, `CVE-2026-103290`, `CVE-2026-105683` · npm `ghost`: affected `>=6.14.0, <6.27.0`, fixed in `6.27.0` · CVSS 5.1 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory](https://agentprime.io/advisories/GHSA-vhhq-m2gm-rwc9.md)
  `GHSA-vhhq-m2gm-rwc9`, `CVE-2026-106108` · npm `@quasar/app-vite`: affected `>=3.1.0, <3.3.0`, fixed in `3.3.0` · CVSS 5.7 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories](https://agentprime.io/advisories/GHSA-q9mq-245r-4g93.md)
  `GHSA-q9mq-245r-4g93`, `CVE-2026-106109` · npm `@quasar/app-vite`: affected `>=1.0.0, <3.3.0`, fixed in `3.3.0` · CVSS 4.1 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile](https://agentprime.io/advisories/GHSA-wmpw-j6qv-mw88.md)
  `GHSA-wmpw-j6qv-mw88`, `CVE-2026-106103` · npm `@quasar/icongenie`: affected `<6.1.1`, fixed in `6.1.1` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Cisco Jabber for Android Path Traversal via Shared Content URI](https://agentprime.io/advisories/CVE-2026-101886.md)
  `CVE-2026-101886` · CVE record: Cisco Jabber for Android · CVSS 5.1 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability](https://agentprime.io/advisories/CVE-2026-76454.md)
  `CVE-2026-76454` · CVE record: Cisco Cisco License On-Prem · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Path traversal in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2026-102257.md)
  `CVE-2026-102257` · CVE record: SonicWall SMA1000 · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Path traversal in visidata](https://agentprime.io/advisories/CVE-2026-41958.md)
  `CVE-2026-41958` · CVE record: visidata visidata · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Path traversal in visidata](https://agentprime.io/advisories/CVE-2026-42532.md)
  `CVE-2026-42532` · CVE record: visidata visidata · CVSS 5.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code](https://agentprime.io/advisories/CVE-2026-103435.md)
  `CVE-2026-103435` · CVE record: Anthropic @anthropic-ai/claude-code · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Race condition, CWE-61
- [Path Traversal in BugTracker.NET](https://agentprime.io/advisories/CVE-2026-92533.md)
  `CVE-2026-92533` · CVE record: BugTracker.NET BugTracker.NET · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Path traversal in Veeam Backup and Replication](https://agentprime.io/advisories/CVE-2026-58069.md)
  `CVE-2026-58069` · CVE record: Veeam Backup and Replication · CVSS 8.3 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Apache Impala: Path traversal executes JARs outside trusted paths](https://agentprime.io/advisories/CVE-2026-90466.md)
  `CVE-2026-90466` · CVE record: Apache Software Foundation Apache Impala · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Path Traversal in Satel Iberia SenNet Datalogger Serie 200](https://agentprime.io/advisories/CVE-2026-5703.md)
  `CVE-2026-5703` · CVE record: Satel Iberia SenNet Datalogger Serie 200 · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Pulp-rpm: distribution tree publish creates directories from .treeinfo ids](https://agentprime.io/advisories/CVE-2026-103870.md)
  `CVE-2026-103870` · CVE record: Red Hat Red Hat Satellite 6 and 2 more · CVSS 5.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93448.md)
  `CVE-2026-93448` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-97671.md)
  `CVE-2026-97671` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-103360.md)
  `CVE-2026-103360` · CVE record: IBM Langflow OSS · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Backstage: TechDocs arbitrary file read via mkdocs snippets](https://agentprime.io/advisories/CVE-2026-106507.md)
  `CVE-2026-106507` · CVE record: backstage backstage and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal, CWE-61
- [Path traversal in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-106552.md)
  `CVE-2026-106552` · CVE record: OpenBSD OpenSSH · CVSS 4.2 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Security Advisory 0189](https://agentprime.io/advisories/CVE-2026-101155.md)
  `CVE-2026-101155` · CVE record: Arista Networks CloudVision Portal · CVSS 8.6 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Security Advisory 0189](https://agentprime.io/advisories/CVE-2026-101154.md)
  `CVE-2026-101154` · CVE record: Arista Networks CloudVision Portal · CVSS 8.6 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Security Advisory 0188](https://agentprime.io/advisories/CVE-2026-101153.md)
  `CVE-2026-101153` · CVE record: Arista Networks CloudVision Portal and 1 more · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass](https://agentprime.io/advisories/CVE-2026-76061.md)
  `CVE-2026-76061` · CVE record: Red Hat Red Hat OpenShift Container Platform 4 · CVSS 5.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Local Arbitrary File Write Leading to Local Privilege Escalation in ClearPass Policy Manager OnGuard Agent](https://agentprime.io/advisories/CVE-2026-79814.md)
  `CVE-2026-79814` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 6.7 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass](https://agentprime.io/advisories/CVE-2026-79809.md)
  `CVE-2026-79809` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 7.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-79805.md)
  `CVE-2026-79805` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-79800.md)
  `CVE-2026-79800` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Path traversal in Dell System Update](https://agentprime.io/advisories/CVE-2026-86360.md)
  `CVE-2026-86360` · CVE record: Dell System Update · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Path traversal in Dell System Update](https://agentprime.io/advisories/CVE-2026-71168.md)
  `CVE-2026-71168` · CVE record: Dell System Update · CVSS 7.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [External control of a file path in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-106219.md)
  `CVE-2026-106219` · CVE record: JetBrains TeamCity · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTEwLTA2VDE2OjMzOjA2Ljg0OTAwMFoiLCJDVkUtMjAyNi0xMDYyMTkiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTEwLTA4VDE1OjIwOjI4LjYwOTAwMFoiLCJDVkUtMjAyNi0xOTU4NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTEwLTA4VDE1OjIwOjI4LjYwOTAwMFoiLCJDVkUtMjAyNi0xOTU4NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.