# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Prime Mover < 2.2.1 Path Traversal via wprime-config.json](https://agentprime.io/advisories/CVE-2026-101889.md)
  `CVE-2026-101889` · CVE record: Codexonics Prime Mover · CVSS 7.0 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Prime Mover < 2.2.1 Zip Slip Path Traversal File Write](https://agentprime.io/advisories/CVE-2026-101888.md)
  `CVE-2026-101888` · CVE record: Codexonics Prime Mover · CVSS 8.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)](https://agentprime.io/advisories/CVE-2026-94620.md)
  `CVE-2026-94620` · CVE record: foundation50 classroom50 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted](https://agentprime.io/advisories/GHSA-7q3f-wx44-378m.md)
  `GHSA-7q3f-wx44-378m`, `CVE-2026-92945` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 2.3 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal, Broken access control
- [WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-95588.md)
  `CVE-2026-95588` · CVE record: AcyMailing Newsletter Team AcyMailing SMTP Newsletter · CVSS 8.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory](https://agentprime.io/advisories/CVE-2026-103754.md)
  `CVE-2026-103754` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 · CVSS 5.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe](https://agentprime.io/advisories/CVE-2026-103278.md)
  `CVE-2026-103278` · CVE record: TryGhost Ghost · CVSS 8.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node](https://agentprime.io/advisories/CVE-2026-103257.md)
  `CVE-2026-103257` · CVE record: n8n-io n8n · CVSS 8.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase](https://agentprime.io/advisories/CVE-2026-103255.md)
  `CVE-2026-103255` · CVE record: n8n-io n8n · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation](https://agentprime.io/advisories/CVE-2026-103254.md)
  `CVE-2026-103254` · CVE record: n8n-io n8n · CVSS 7.0 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter](https://agentprime.io/advisories/CVE-2026-15983.md)
  `CVE-2026-15983` · CVE record: WebRehab Super Forms – Drag & Drop Form Builder · CVSS 8.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Path traversal in Fujifilm Business Innovation Corp. Apeos 3060 / 2560 / 1860 Japan model and others](https://agentprime.io/advisories/CVE-2026-78249.md)
  `CVE-2026-78249` · CVE record: Fujifilm Business Innovation Corp. Apeos 3060 / 2560 / 1860 Japan model and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Path traversal in dynamically created BACnet File Objects](https://agentprime.io/advisories/CVE-2025-41753.md)
  `CVE-2025-41753` · CVE record: WAGO 0751-9x01 and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url](https://agentprime.io/advisories/CVE-2026-19253.md)
  `CVE-2026-19253` · CVE record: Unknown Cache Enabler · CVSS 8.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key](https://agentprime.io/advisories/CVE-2026-101148.md)
  `CVE-2026-101148` · CVE record: Unknown BackupSheep WordPress Backup Plugin · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Path traversal may allow arbitrary files to be viewed, created, modified, or deleted](https://agentprime.io/advisories/CVE-2026-82824.md)
  `CVE-2026-82824` · CVE record: Hitachi Industrial Equipment Systems Hitachi Coding Software Suite · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Genians, Inc Genian NAC/ZTNA Remote Code Execution](https://agentprime.io/advisories/CVE-2026-76147.md)
  `CVE-2026-76147` · CVE record: Genians, Inc Genian NAC 4.0.175 Release and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal, Broken access control, CWE-807
- [David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal](https://agentprime.io/advisories/CVE-2026-103533.md)
  `CVE-2026-103533` · CVE record: David-Crty databasement · CVSS 2.1 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [langflow-ai langflow v1.8.4 is affected by: Directory Traversal.](https://agentprime.io/advisories/CVE-2026-51888.md)
  `CVE-2026-51888` · CVE record · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal.](https://agentprime.io/advisories/CVE-2026-51884.md)
  `CVE-2026-51884` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal.](https://agentprime.io/advisories/CVE-2026-51883.md)
  `CVE-2026-51883` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [The OpenAI-compatible file upload endpoint \`/v1/files\` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal.](https://agentprime.io/advisories/CVE-2026-51882.md)
  `CVE-2026-51882` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute.](https://agentprime.io/advisories/CVE-2026-51880.md)
  `CVE-2026-51880` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compro…](https://agentprime.io/advisories/CVE-2026-51875.md)
  `CVE-2026-51875` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace.](https://agentprime.io/advisories/CVE-2026-51874.md)
  `CVE-2026-51874` · CVE record · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.](https://agentprime.io/advisories/CVE-2026-51873.md)
  `CVE-2026-51873` · CVE record · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Tornado: StaticFileHandler follows symlinks outside static root (path traversal)](https://agentprime.io/advisories/GHSA-c2m8-h5v5-343r.md)
  `GHSA-c2m8-h5v5-343r`, `CVE-2026-103263` · PyPI `tornado`: affected `<6.5.9`, fixed in `6.5.9` · CVSS 8.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [GitPython submodule update path traversal can write outside the repository](https://agentprime.io/advisories/GHSA-59cr-6r3x-644w.md)
  `GHSA-59cr-6r3x-644w`, `CVE-2026-100689` · PyPI `gitpython`: affected `<3.1.62`, fixed in `3.1.62` · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/file](https://agentprime.io/advisories/CVE-2026-103591.md)
  `CVE-2026-103591` · CVE record: AsyncFuncAI deepwiki-open · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Yonyou U8 CRM Arbitrary File Read via getemaildata.php](https://agentprime.io/advisories/CVE-2023-54403.md)
  `CVE-2023-54403` · CVE record: Yonyou U8 CRM · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Inspur HCM Cloud Arbitrary File Read via file/download Endpoint](https://agentprime.io/advisories/CVE-2024-58387.md)
  `CVE-2024-58387` · CVE record: Inspur Haiyue HCM Cloud · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Kiteworks Core Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-102113.md)
  `CVE-2026-102113` · CVE record: Kiteworks Core · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Privilege escalation
- [Kiteworks Email Protection Gateway Path Traversal](https://agentprime.io/advisories/CVE-2026-102116.md)
  `CVE-2026-102116` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Other injection
- [Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-102118.md)
  `CVE-2026-102118` · CVE record: Kiteworks Core · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Privilege escalation
- [Kiteworks Email Protection Gateway Path Traversal](https://agentprime.io/advisories/CVE-2026-102119.md)
  `CVE-2026-102119` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Kiteworks Core Path Traversal](https://agentprime.io/advisories/CVE-2026-102123.md)
  `CVE-2026-102123` · CVE record: Kiteworks Core · CVSS 7.4 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Kiteworks Core Privilege Escalation through External Control of File Name or Path](https://agentprime.io/advisories/CVE-2026-102141.md)
  `CVE-2026-102141` · CVE record: Kiteworks Core · CVSS 6.7 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Privilege escalation
- [Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection](https://agentprime.io/advisories/CVE-2026-102146.md)
  `CVE-2026-102146` · CVE record: Kiteworks Email Protection Gateway · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Kiteworks Email Protection Gateway remote code execution](https://agentprime.io/advisories/CVE-2026-102097.md)
  `CVE-2026-102097` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Code injection
- [Kiteworks Core arbitrary file write](https://agentprime.io/advisories/CVE-2026-102099.md)
  `CVE-2026-102099` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Kiteworks Email Protection Gateway path traversal](https://agentprime.io/advisories/CVE-2026-102089.md)
  `CVE-2026-102089` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path](https://agentprime.io/advisories/CVE-2026-101885.md)
  `CVE-2026-101885` · CVE record: zeroclaw-labs ZeroClaw · CVSS 8.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path](https://agentprime.io/advisories/CVE-2026-103398.md)
  `CVE-2026-103398` · CVE record: Liquid-co OpenSave · CVSS 8.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction](https://agentprime.io/advisories/CVE-2026-101295.md)
  `CVE-2026-101295` · CVE record: Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 and 2 more · CVSS 7.3 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability](https://agentprime.io/advisories/CVE-2026-97244.md)
  `CVE-2026-97244` · CVE record: WPFunnels Creator LMS · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-97242.md)
  `CVE-2026-97242` · CVE record: phuongwebo WEBO MCP · CVSS 6.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-96824.md)
  `CVE-2026-96824` · CVE record: envato Template Kit – Import · CVSS 6.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability](https://agentprime.io/advisories/CVE-2026-94123.md)
  `CVE-2026-94123` · CVE record: Syed Balkhi NextGEN Gallery · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation](https://agentprime.io/advisories/CVE-2026-10726.md)
  `CVE-2026-10726` · CVE record: Cato Networks SDP Client · CVSS 6.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Weak cryptography or TLS
- [Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-10739.md)
  `CVE-2026-10739` · CVE record: Cato Networks SDP Client · CVSS 8.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [DigiWin｜EasyFlow .NET - Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-102457.md)
  `CVE-2026-102457` · CVE record: DigiWin EasyFlow .NET · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design](https://agentprime.io/advisories/CVE-2026-75098.md)
  `CVE-2026-75098` · CVE record: productdesignerapp Product Designer App · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler](https://agentprime.io/advisories/CVE-2026-91072.md)
  `CVE-2026-91072` · CVE record: Unknown EWWW Image Optimizer · CVSS 4.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Symlink following in PFU Limited Image Scanner Driver for Linux (fi Series) and others](https://agentprime.io/advisories/CVE-2026-81310.md)
  `CVE-2026-81310` · CVE record: PFU Limited Image Scanner Driver for Linux (fi Series) and 1 more · CVSS 5.2 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [gedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal](https://agentprime.io/advisories/CVE-2026-102843.md)
  `CVE-2026-102843` · CVE record: gedelumbung HospitalManagement · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Path traversal in jknack handlebars.java](https://agentprime.io/advisories/CVE-2026-103088.md)
  `CVE-2026-103088` · CVE record: jknack handlebars.java · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42).](https://agentprime.io/advisories/CVE-2026-51864.md)
  `CVE-2026-51864` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40).](https://agentprime.io/advisories/CVE-2026-51862.md)
  `CVE-2026-51862` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.](https://agentprime.io/advisories/CVE-2026-51860.md)
  `CVE-2026-51860` · CVE record · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).](https://agentprime.io/advisories/CVE-2026-51859.md)
  `CVE-2026-51859` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA5LTMwVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi01MTg1OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTEwLTAxVDE3OjE2OjIxLjA5MzAwMFoiLCJDVkUtMjAyNi0xMDM4ODQiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTEwLTAxVDE3OjE2OjIxLjA5MzAwMFoiLCJDVkUtMjAyNi0xMDM4ODQiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.