# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-112483.md)
  `CVE-2026-112483` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Symlink following in Apple macOS](https://agentprime.io/advisories/CVE-2026-112513.md)
  `CVE-2026-112513` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-112504.md)
  `CVE-2026-112504` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-112545.md)
  `CVE-2026-112545` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-112512.md)
  `CVE-2026-112512` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-86877.md)
  `CVE-2026-86877` · CVE record: Apple macOS · CVSS 6.2 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-112562.md)
  `CVE-2026-112562` · CVE record: Apple macOS · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112690.md)
  `CVE-2026-112690` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-112612.md)
  `CVE-2026-112612` · CVE record: Apple iOS and iPadOS · CVSS 6.2 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-112487.md)
  `CVE-2026-112487` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-112453.md)
  `CVE-2026-112453` · CVE record: Apple macOS · CVSS 7.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Symlink following in Apple macOS](https://agentprime.io/advisories/CVE-2026-112511.md)
  `CVE-2026-112511` · CVE record: Apple macOS · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-84633.md)
  `CVE-2026-84633` · CVE record: Apple macOS · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Symlink following in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86966.md)
  `CVE-2026-86966` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape](https://agentprime.io/advisories/CVE-2026-112344.md)
  `CVE-2026-112344` · CVE record: Syncplify, Inc. Syncplify Server! · CVSS 7.6 High · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files](https://agentprime.io/advisories/CVE-2026-110748.md)
  `CVE-2026-110748` · CVE record: Apache Software Foundation Apache SIS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write](https://agentprime.io/advisories/CVE-2026-93328.md)
  `CVE-2026-93328` · CVE record: Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal, Broken access control
- [Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks](https://agentprime.io/advisories/CVE-2026-116213.md)
  `CVE-2026-116213` · CVE record: Webasyst Webasyst Framework · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [A path traversal vulnerability exists in the Mautic Asset API.](https://agentprime.io/advisories/CVE-2026-115194.md)
  `CVE-2026-115194` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Arbitrary File Read in Innotim Software's Logsign SIEM](https://agentprime.io/advisories/CVE-2026-105947.md)
  `CVE-2026-105947` · CVE record: Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [PGYER codefever URI Sanitizer doc.php \_detail path traversal](https://agentprime.io/advisories/CVE-2026-116255.md)
  `CVE-2026-116255` · CVE record: PGYER codefever · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)](https://agentprime.io/advisories/CVE-2026-95628.md)
  `CVE-2026-95628` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.4 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory](https://agentprime.io/advisories/CVE-2026-95629.md)
  `CVE-2026-95629` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.4 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal](https://agentprime.io/advisories/CVE-2026-116117.md)
  `CVE-2026-116117` · CVE record: halo-dev halo · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.](https://agentprime.io/advisories/CVE-2026-107092.md)
  `CVE-2026-107092` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim](https://agentprime.io/advisories/CVE-2026-116195.md)
  `CVE-2026-116195` · CVE record: rclone rclone · CVSS 7.0 High · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [Rclone before 1.75.2 Path Traversal via serve webdav MKCOL](https://agentprime.io/advisories/CVE-2026-116191.md)
  `CVE-2026-116191` · CVE record: rclone rclone · CVSS 8.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix](https://agentprime.io/advisories/CVE-2026-116171.md)
  `CVE-2026-116171` · CVE record: siyuan-note siyuan · CVSS 5.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool](https://agentprime.io/advisories/CVE-2026-116168.md)
  `CVE-2026-116168` · CVE record: siyuan-note siyuan · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [Leon before commit 50df142 Path Traversal via /download model Command](https://agentprime.io/advisories/CVE-2026-116073.md)
  `CVE-2026-116073` · CVE record: leon-ai leon · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [Paisa before 0.7.8 Path Traversal via Editor and Sheet API](https://agentprime.io/advisories/CVE-2026-116067.md)
  `CVE-2026-116067` · CVE record: ananthakumaran paisa · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal](https://agentprime.io/advisories/CVE-2026-116046.md)
  `CVE-2026-116046` · CVE record: eventcatalog sdk · CVSS 4.8 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal](https://agentprime.io/advisories/CVE-2026-116045.md)
  `CVE-2026-116045` · CVE record: 1999AZZAR designer-mcp · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import](https://agentprime.io/advisories/CVE-2026-111978.md)
  `CVE-2026-111978` · CVE record: Unknown GiveWP · CVSS 6.0 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [Path traversal in post media lets any registered user read server files](https://agentprime.io/advisories/CVE-2026-115932.md)
  `CVE-2026-115932` · CVE record: GitroomHQ postiz-app · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Path traversal, Other injection
- [Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action](https://agentprime.io/advisories/CVE-2026-116009.md)
  `CVE-2026-116009` · CVE record: owen2345 camaleon-cms · CVSS 8.7 High · Not analysed yet · Published 24 Oct 2026 · Tags: Path traversal
- [GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal](https://agentprime.io/advisories/CVE-2026-113491.md)
  `CVE-2026-113491` · CVE record: Unknown GeoDirectory · CVSS 6.4 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Path traversal
- [virtualenv: Seed replacement does not contain metadata deletion paths](https://agentprime.io/advisories/GHSA-hhxq-47xx-j5xx.md)
  `GHSA-hhxq-47xx-j5xx`, `BIT-virtualenv-2026-113719`, `CVE-2026-113719` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 4.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [Arbitrary file read and backend crash through unrestricted provider method calls](https://agentprime.io/advisories/CVE-2026-115931.md)
  `CVE-2026-115931` · CVE record: GitroomHQ postiz-app · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, Code injection
- [filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory](https://agentprime.io/advisories/GHSA-crv4-6mhj-j5jh.md)
  `GHSA-crv4-6mhj-j5jh`, `CVE-2026-112914` · PyPI `filelock`: affected `>=4.1.0, <4.2.1`, fixed in `4.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, CWE-363
- [filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files](https://agentprime.io/advisories/GHSA-v4x8-3wr5-3wq8.md)
  `GHSA-v4x8-3wr5-3wq8`, `CVE-2026-112940` · PyPI `filelock`: affected `>=3.20.4, <4.2.1`, fixed in `4.2.1` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, CWE-363
- [Fallow: A \`.\*\` glob segment let an analyzed repository make Fallow test paths in the parent of the project root](https://agentprime.io/advisories/GHSA-h4fr-cmh5-qr62.md)
  `GHSA-h4fr-cmh5-qr62` · crates.io `fallow-cli` and 4 more: affected `<3.34.0`, fixed in `3.34.0` · CVSS 3.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [Fallow: Jest and Vitest \`projects\` entries let an analyzed repository make Fallow read files outside the project root](https://agentprime.io/advisories/GHSA-jfwm-3p3c-6hx5.md)
  `GHSA-jfwm-3p3c-6hx5`, `CVE-2026-115569` · crates.io `fallow-cli` and 3 more: affected `>=2.68.0, <3.34.0`, fixed in `3.34.0` · CVSS 3.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description](https://agentprime.io/advisories/GHSA-xmj3-9gf7-h52w.md)
  `GHSA-xmj3-9gf7-h52w` · PyPI `setuptools`: affected `>=38.2.2, <84.1.0`, fixed in `84.1.0` · CVSS 4.0, no score published · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [Mistune: Path Traversal and XSS in Include directive](https://agentprime.io/advisories/GHSA-h7ww-273w-6cm8.md)
  `GHSA-h7ww-273w-6cm8`, `CVE-2026-115355` · PyPI `mistune`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [UbiquitousLearning mllm Convertor \_\_init\_\_.py load_model path traversal](https://agentprime.io/advisories/CVE-2026-115800.md)
  `CVE-2026-115800` · CVE record: UbiquitousLearning mllm · CVSS 4.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server](https://agentprime.io/advisories/CVE-2026-115812.md)
  `CVE-2026-115812` · CVE record: AWS multi-model-server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [obsidian-tc : Symlink read-ACL scope bypass via lexical path checks](https://agentprime.io/advisories/GHSA-c5xx-h28h-f682.md)
  `GHSA-c5xx-h28h-f682`, `CVE-2026-77361` · npm `obsidian-tc`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 4.7 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, Broken access control
- [Path traversal via HTTP \`Content-Disposition\` header in ExternalFilesDownloader enables remote code execution in Goobi viewer](https://agentprime.io/advisories/CVE-2026-46652.md)
  `CVE-2026-46652` · CVE record: intranda goobi-viewer-core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure](https://agentprime.io/advisories/CVE-2026-114623.md)
  `CVE-2026-114623` · CVE record: baserproject basercms · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, Information disclosure, Broken access control
- [baserCMS: Encoded path traversal bypass in the theme file API](https://agentprime.io/advisories/CVE-2026-114622.md)
  `CVE-2026-114622` · CVE record: baserproject basercms · CVSS 7.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, CWE-180
- [XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal](https://agentprime.io/advisories/CVE-2026-55888.md)
  `CVE-2026-55888` · CVE record: flatpak xdg-desktop-portal · CVSS 8.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-63120.md)
  `CVE-2026-63120` · CVE record: Aiven-Open pghoard · CVSS 8.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter](https://agentprime.io/advisories/CVE-2026-115497.md)
  `CVE-2026-115497` · CVE record: codepeople Music Store – WordPress eCommerce · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [Kiloview E3 NDI Encoder Path Traversal](https://agentprime.io/advisories/CVE-2026-105265.md)
  `CVE-2026-105265` · CVE record: Kiloview E3 Firmware · CVSS 6.0 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-110063.md)
  `CVE-2026-110063` · CVE record: Microsoft VM Inspector for Azure Virtual Machines · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive](https://agentprime.io/advisories/GHSA-8cqv-vvq2-6p8c.md)
  `GHSA-8cqv-vvq2-6p8c` · PyPI `mistune`: affected `*`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [tar filter allows writing outside destination via empty-named symlink](https://agentprime.io/advisories/CVE-2026-114583.md)
  `CVE-2026-114583` · CVE record: Python Software Foundation CPython · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull](https://agentprime.io/advisories/CVE-2026-115378.md)
  `CVE-2026-115378` · CVE record: lxc incus · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream](https://agentprime.io/advisories/CVE-2026-115377.md)
  `CVE-2026-115377` · CVE record: lxc incus · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTEwLTIyVDE5OjEzOjQ2LjMwNTAwMFoiLCJDVkUtMjAyNi0xMTUzNzciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTEwLTI2VDIyOjI5OjIzLjk0NDAwMFoiLCJDVkUtMjAyNi03NjY1NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTEwLTI2VDIyOjI5OjIzLjk0NDAwMFoiLCJDVkUtMjAyNi03NjY1NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.