# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints](https://agentprime.io/advisories/CVE-2026-111618.md)
  `CVE-2026-111618` · CVE record: coaidev CoAI · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files](https://agentprime.io/advisories/CVE-2026-41582.md)
  `CVE-2026-41582` · CVE record: Countly countly-server · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion](https://agentprime.io/advisories/CVE-2026-42269.md)
  `CVE-2026-42269` · CVE record: Countly countly-server · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [Thermo Fisher Torrent Suite Software Path Traversal](https://agentprime.io/advisories/CVE-2026-107777.md)
  `CVE-2026-107777` · CVE record: Thermo Fisher Torrent Suite Software · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb](https://agentprime.io/advisories/CVE-2026-109118.md)
  `CVE-2026-109118` · CVE record: ikus-soft rdiffweb · CVSS 4.6 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path](https://agentprime.io/advisories/CVE-2026-103896.md)
  `CVE-2026-103896` · CVE record: 10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter](https://agentprime.io/advisories/CVE-2026-93767.md)
  `CVE-2026-93767` · CVE record: tainacan Tainacan · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping](https://agentprime.io/advisories/CVE-2026-109221.md)
  `CVE-2026-109221` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed \<link>](https://agentprime.io/advisories/CVE-2026-104769.md)
  `CVE-2026-104769` · CVE record: asadkn Debloat – Remove Unused CSS, Optimize JS · CVSS 5.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role](https://agentprime.io/advisories/CVE-2026-84823.md)
  `CVE-2026-84823` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Microsoft Office SharePoint Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-108452.md)
  `CVE-2026-108452` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-105037.md)
  `CVE-2026-105037` · CVE record: EnergizeLab station-middleware · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-105032.md)
  `CVE-2026-105032` · CVE record: EnergizeLab FastAPI AI inference server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, Unrestricted file upload
- [Appium: Symlink based Zip Slip in @appium/support ZIP extraction](https://agentprime.io/advisories/GHSA-qfxx-c367-67f8.md)
  `GHSA-qfxx-c367-67f8`, `CVE-2026-103975` · npm `@appium/support`: affected `<7.2.6`, fixed in `7.2.6` · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [copyparty FTP: upload outside defined volumes (limited path traversal)](https://agentprime.io/advisories/GHSA-phv8-wgjp-g4p9.md)
  `GHSA-phv8-wgjp-g4p9`, `CVE-2026-104102` · PyPI `copyparty`: affected `<1.20.19`, fixed in `1.20.19` · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Nginx UI: Auto backup name allows path traversal outside validated storage path](https://agentprime.io/advisories/GHSA-jrq7-xrjx-pcfw.md)
  `GHSA-jrq7-xrjx-pcfw`, `CVE-2026-84320`, `GO-2026-6788` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260715121709-f92218e01054`, fixed in `1.9.10-0.20260715121709-f92218e01054` · CVSS 6.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [borg extract might modify out-of-tree files when extracting maliciously crafted archives](https://agentprime.io/advisories/GHSA-gfp8-w835-v44j.md)
  `GHSA-gfp8-w835-v44j`, `CVE-2026-62268` · PyPI `borgbackup`: affected `<1.4.5 || >=2.0.0b1, <2.0.0b22`, fixed in `1.4.5`, `2.0.0b22` · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [SimplePie through 1.9.0 Local File Read via file:// Redirect](https://agentprime.io/advisories/CVE-2026-111234.md)
  `CVE-2026-111234` · CVE record: SimplePie simplepie · CVSS 8.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL](https://agentprime.io/advisories/CVE-2026-111230.md)
  `CVE-2026-111230` · CVE record: Netgate pfSense CE · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Terragrunt catalog predictable temp symlink clobber](https://agentprime.io/advisories/GHSA-wv6g-x823-wx9m.md)
  `GHSA-wv6g-x823-wx9m`, `CVE-2026-64672`, `GO-2026-6768` · Go `github.com/gruntwork-io/terragrunt`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 4.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, CWE-377
- [GitHub CLI allows path traversal through unescaped request URL components](https://agentprime.io/advisories/GHSA-4fjg-2h4q-fwg3.md)
  `GHSA-4fjg-2h4q-fwg3`, `CVE-2026-64653`, `GO-2026-6765` · Go `github.com/cli/cli/v2`: affected `<2.97.0`, fixed in `2.97.0` · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [OpenPrinting CUPS: root-side banner file disclosure](https://agentprime.io/advisories/CVE-2026-61702.md)
  `CVE-2026-61702` · CVE record: OpenPrinting cups · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)](https://agentprime.io/advisories/CVE-2026-55480.md)
  `CVE-2026-55480` · CVE record: OpenPrinting cups · CVSS 5.7 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, CWE-377
- [Lychee: Path traversal in \`SecurePathController\` allows authenticated arbitrary file read](https://agentprime.io/advisories/CVE-2026-62679.md)
  `CVE-2026-62679` · CVE record: LycheeOrg Lychee · CVSS 8.9 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name](https://agentprime.io/advisories/CVE-2026-85634.md)
  `CVE-2026-85634` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1 and 4 more · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Path traversal in JetBrains Datalore](https://agentprime.io/advisories/CVE-2026-111093.md)
  `CVE-2026-111093` · CVE record: JetBrains Datalore · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files](https://agentprime.io/advisories/CVE-2026-58393.md)
  `CVE-2026-58393` · CVE record: opnsense core · CVSS 5.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer](https://agentprime.io/advisories/CVE-2026-57155.md)
  `CVE-2026-57155` · CVE record: opnsense core · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, Command injection
- [EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary \`.json\` file read, write and delete](https://agentprime.io/advisories/CVE-2026-63130.md)
  `CVE-2026-63130` · CVE record: espocrm espocrm · CVSS 5.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [CVE-2026-110746](https://agentprime.io/advisories/CVE-2026-110746.md)
  `CVE-2026-110746` · CVE record: TotalSecurity TotalAV · CVSS 7.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Path traversal via logging configuration in P4Search](https://agentprime.io/advisories/CVE-2026-103508.md)
  `CVE-2026-103508` · CVE record: Perforce P4 (Helix core) · CVSS 7.3 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name](https://agentprime.io/advisories/CVE-2026-104025.md)
  `CVE-2026-104025` · CVE record: PeaZip PeaZip · CVSS 8.4 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, CWE-693
- [Unauthenticated remote code execution vulnerability](https://agentprime.io/advisories/CVE-2026-50619.md)
  `CVE-2026-50619` · CVE record: QNAP Systems Inc. Qsirch · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Path Traversal in Virtualization Station VM Import](https://agentprime.io/advisories/CVE-2026-53882.md)
  `CVE-2026-53882` · CVE record: QNAP Systems Inc. Virtualization Station · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [WebSocket timelapse path traversal and command injection](https://agentprime.io/advisories/CVE-2026-41545.md)
  `CVE-2026-41545` · CVE record: QNAP Systems Inc. QuMagie · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, Command injection
- [Remote Code Execution in upload.php of Video Station](https://agentprime.io/advisories/CVE-2026-34015.md)
  `CVE-2026-34015` · CVE record: QNAP Systems Inc. Video Station · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Arbitrary Folder Deletion in Qsync Central 5.0.0.5](https://agentprime.io/advisories/CVE-2026-26243.md)
  `CVE-2026-26243` · CVE record: QNAP Systems Inc. Qsync Central · CVSS 7.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint](https://agentprime.io/advisories/CVE-2026-41544.md)
  `CVE-2026-41544` · CVE record: QNAP Systems Inc. QcalAgent · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter](https://agentprime.io/advisories/CVE-2026-39993.md)
  `CVE-2026-39993` · CVE record: QNAP Systems Inc. Download Station · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi](https://agentprime.io/advisories/CVE-2026-24718.md)
  `CVE-2026-24718` · CVE record: QNAP Systems Inc. Qsync Central · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Remote code execution via command injection](https://agentprime.io/advisories/CVE-2025-66275.md)
  `CVE-2025-66275` · CVE record: QNAP Systems Inc. Video Station · CVSS 7.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Arbitrary file deletion and remote code execution](https://agentprime.io/advisories/CVE-2025-66272.md)
  `CVE-2025-66272` · CVE record: QNAP Systems Inc. Video Station · CVSS 7.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.](https://agentprime.io/advisories/CVE-2026-78851.md)
  `CVE-2026-78851` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, Information disclosure
- [FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root](https://agentprime.io/advisories/CVE-2026-104109.md)
  `CVE-2026-104109` · CVE record: error311 FileRise · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs](https://agentprime.io/advisories/CVE-2026-104107.md)
  `CVE-2026-104107` · CVE record: error311 FileRise · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [Checkov by Prisma Cloud: Path Traversal Vulnerabilities](https://agentprime.io/advisories/CVE-2026-0312.md)
  `CVE-2026-0312` · CVE record: Palo Alto Networks Checkov by Prisma Cloud · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root](https://agentprime.io/advisories/CVE-2026-62664.md)
  `CVE-2026-62664` · CVE record: error311 FileRise · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [FileRise Shared Folder Symlink Escape](https://agentprime.io/advisories/CVE-2026-55498.md)
  `CVE-2026-55498` · CVE record: error311 FileRise · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation](https://agentprime.io/advisories/CVE-2026-54703.md)
  `CVE-2026-54703` · CVE record: shd101wyy vscode-markdown-preview-enhanced · CVSS 5.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion](https://agentprime.io/advisories/CVE-2026-110767.md)
  `CVE-2026-110767` · CVE record: coderamp-labs gitingest · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [Colanode Server through 0.4.7 Path Traversal via Avatar Download Route](https://agentprime.io/advisories/CVE-2026-110766.md)
  `CVE-2026-110766` · CVE record: colanode colanode · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [cemtan sar2html File Upload sar2html.py updateDb path traversal](https://agentprime.io/advisories/CVE-2026-110666.md)
  `CVE-2026-110666` · CVE record: cemtan sar2html · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [dbt: Unauthenticated Arbitrary SQL Execution in \`dbt docs serve\`](https://agentprime.io/advisories/CVE-2026-100406.md)
  `CVE-2026-100406` · CVE record: dbt-labs dbt-core · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal, Information disclosure, Authentication bypass
- [Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members](https://agentprime.io/advisories/CVE-2026-104103.md)
  `CVE-2026-104103` · CVE record: ludwig-ai ludwig · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath](https://agentprime.io/advisories/CVE-2026-92153.md)
  `CVE-2026-92153` · CVE record: nasa fprime · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [Cisco Secure Email Gateway Arbitrary File Write Vulnerability](https://agentprime.io/advisories/CVE-2026-76519.md)
  `CVE-2026-76519` · CVE record: Cisco Cisco Secure Email · CVSS 9.8 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename](https://agentprime.io/advisories/CVE-2026-110717.md)
  `CVE-2026-110717` · CVE record: meetecho janus-gateway · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label](https://agentprime.io/advisories/CVE-2026-110657.md)
  `CVE-2026-110657` · CVE record: Khronos Group nnef and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [Gitea Org-mode file disclosure and code execution](https://agentprime.io/advisories/CVE-2026-59774.md)
  `CVE-2026-59774` · CVE record: Gitea Gitea · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [Path traversal in Dell Unisphere for PowerMax vApp](https://agentprime.io/advisories/CVE-2026-101217.md)
  `CVE-2026-101217` · CVE record: Dell Unisphere for PowerMax vApp · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTEwLTE0VDEzOjUwOjA4Ljg3NjAwMFoiLCJDVkUtMjAyNi0xMDEyMTciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTEwLTE2VDE3OjM5OjA3LjU3MTAwMFoiLCJDVkUtMjAyNi0xMTE2MzUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTEwLTE2VDE3OjM5OjA3LjU3MTAwMFoiLCJDVkUtMjAyNi0xMTE2MzUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.