# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php](https://agentprime.io/advisories/CVE-2016-20104.md)
  `CVE-2016-20104` · CVE record: EyeLock nano NXT · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php](https://agentprime.io/advisories/CVE-2016-20103.md)
  `CVE-2016-20103` · CVE record: Cherry Team Cherry Plugin · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview](https://agentprime.io/advisories/CVE-2016-20100.md)
  `CVE-2016-20100` · CVE record: Ian Howatson Memphis Documents Library · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php](https://agentprime.io/advisories/CVE-2015-20125.md)
  `CVE-2015-20125` · CVE record: Aspose Aspose PDF Exporter · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php](https://agentprime.io/advisories/CVE-2015-20124.md)
  `CVE-2015-20124` · CVE record: Aspose Aspose Importer & Exporter · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php](https://agentprime.io/advisories/CVE-2015-20123.md)
  `CVE-2015-20123` · CVE record: Aspose Aspose Doc Exporter · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php](https://agentprime.io/advisories/CVE-2014-125134.md)
  `CVE-2014-125134` · CVE record: ChurcHope ChurcHope · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php](https://agentprime.io/advisories/CVE-2014-125133.md)
  `CVE-2014-125133` · CVE record: imithemes NativeChurch · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php](https://agentprime.io/advisories/CVE-2012-20002.md)
  `CVE-2012-20002` · CVE record: James Charlesworth TinyMCE Thumbnail Gallery · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Path traversal in Totolink](https://agentprime.io/advisories/CVE-2026-9827.md)
  `CVE-2026-9827` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [\-J no-clobber guarantee bypassed with 103 early hints](https://agentprime.io/advisories/CVE-2026-92390.md)
  `CVE-2026-92390` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test](https://agentprime.io/advisories/GHSA-97wv-p4xx-c7mg.md)
  `GHSA-97wv-p4xx-c7mg`, `CVE-2026-113664` · npm `@apostrophecms/import-export`: affected `<3.7.0`, fixed in `3.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [ApostropheCMS: Path traversal in uploadfs](https://agentprime.io/advisories/GHSA-gmfx-5g6x-rr72.md)
  `GHSA-gmfx-5g6x-rr72`, `CVE-2026-113651` · npm `uploadfs`: affected `<1.28.0`, fixed in `1.28.0` · CVSS 3.3 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Argo CD: A Jsonnet import can read files from the repo-server](https://agentprime.io/advisories/CVE-2026-113672.md)
  `CVE-2026-113672` · CVE record: argoproj argo-cd · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId](https://agentprime.io/advisories/CVE-2026-105772.md)
  `CVE-2026-105772` · CVE record: Google ADK TypeScript (@google/adk) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [aaPanel Download Endpoint v2.py send_file path traversal](https://agentprime.io/advisories/CVE-2026-113505.md)
  `CVE-2026-113505` · CVE record: aaPanel · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron](https://agentprime.io/advisories/CVE-2026-113678.md)
  `CVE-2026-113678` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin](https://agentprime.io/advisories/CVE-2026-113613.md)
  `CVE-2026-113613` · CVE record: FlexGet FlexGet · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream](https://agentprime.io/advisories/CVE-2026-92162.md)
  `CVE-2026-92162` · CVE record: flatpak flatpak · CVSS 7.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal](https://agentprime.io/advisories/CVE-2026-113395.md)
  `CVE-2026-113395` · CVE record: DrayTek Vigor2960 · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal](https://agentprime.io/advisories/CVE-2026-113394.md)
  `CVE-2026-113394` · CVE record: DrayTek Vigor2960 · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal](https://agentprime.io/advisories/CVE-2026-113392.md)
  `CVE-2026-113392` · CVE record: DrayTek Vigor2960 · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers](https://agentprime.io/advisories/CVE-2026-113352.md)
  `CVE-2026-113352` · CVE record: uTox uTox · CVSS 7.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Path traversal in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43852.md)
  `CVE-2026-43852` · CVE record: Advantech ADAM-3600 · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Path traversal in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43851.md)
  `CVE-2026-43851` · CVE record: Advantech ADAM-3600 · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-86928.md)
  `CVE-2026-86928` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [MLflow FileStore trace IDs allow path traversal and arbitrary file writes](https://agentprime.io/advisories/GHSA-wqmh-qccw-pqwf.md)
  `GHSA-wqmh-qccw-pqwf`, `BIT-mlflow-2026-53995`, `CVE-2026-53995` · PyPI `mlflow`: affected `<3.17.2`, fixed in `3.17.2` · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [H3C Magic NX15 upload importprofile path traversal](https://agentprime.io/advisories/CVE-2026-112372.md)
  `CVE-2026-112372` · CVE record: H3C Magic NX15 · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [kiwilan php-archive Extraction ArchiveZip.php extract path traversal](https://agentprime.io/advisories/CVE-2026-112302.md)
  `CVE-2026-112302` · CVE record: kiwilan php-archive · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal](https://agentprime.io/advisories/CVE-2026-112248.md)
  `CVE-2026-112248` · CVE record: grandnode grandnode2 · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivity](https://agentprime.io/advisories/CVE-2026-11319.md)
  `CVE-2026-11319` · CVE record: TickTick Limited TickTick for Android · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo](https://agentprime.io/advisories/GHSA-pcc4-rvhr-2pr8.md)
  `GHSA-pcc4-rvhr-2pr8` · PyPI `graphifyy`: affected `>=0.7.2, <0.9.70`, fixed in `0.9.70` · CVSS 4.0, no score published · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [IBM MQ Path Traversal](https://agentprime.io/advisories/CVE-2026-12660.md)
  `CVE-2026-12660` · CVE record: IBM MQ Operator and 1 more · CVSS 2.7 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists](https://agentprime.io/advisories/CVE-2026-111053.md)
  `CVE-2026-111053` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal, Information disclosure
- [CLI Bridge: High-severity sandbox escape via dangling symlink](https://agentprime.io/advisories/CVE-2026-111045.md)
  `CVE-2026-111045` · CVE record: anshupriyan cli-bridge · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef](https://agentprime.io/advisories/CVE-2026-112310.md)
  `CVE-2026-112310` · CVE record: docling-project docling-core · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis](https://agentprime.io/advisories/CVE-2026-111935.md)
  `CVE-2026-111935` · CVE record: codexu NoteGen · CVSS 2.1 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Mopidy before 4.0.5 Path Traversal via File Backend library.lookup](https://agentprime.io/advisories/CVE-2026-111925.md)
  `CVE-2026-111925` · CVE record: Mopidy Mopidy · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Yank Note before 3.93.1 Path Traversal via /api/help Endpoint](https://agentprime.io/advisories/CVE-2026-111915.md)
  `CVE-2026-111915` · CVE record: purocean Yank Note · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service](https://agentprime.io/advisories/CVE-2026-112210.md)
  `CVE-2026-112210` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 6.0 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [diem-project diem dmCodeEditor actions.class.php join path traversal](https://agentprime.io/advisories/CVE-2026-112138.md)
  `CVE-2026-112138` · CVE record: diem-project diem · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing en…](https://agentprime.io/advisories/CVE-2026-79986.md)
  `CVE-2026-79986` · CVE record: Apache Software Foundation Apache Camel · CVSS 7.4 High · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry cont…](https://agentprime.io/advisories/CVE-2026-79985.md)
  `CVE-2026-79985` · CVE record: Apache Software Foundation Apache Camel · CVSS 7.4 High · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entr…](https://agentprime.io/advisories/CVE-2026-79984.md)
  `CVE-2026-79984` · CVE record: Apache Software Foundation Apache Camel · CVSS 7.4 High · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry cont…](https://agentprime.io/advisories/CVE-2026-79983.md)
  `CVE-2026-79983` · CVE record: Apache Software Foundation Apache Camel · CVSS 7.4 High · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure](https://agentprime.io/advisories/CVE-2026-78163.md)
  `CVE-2026-78163` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal, Information disclosure, Server-side request forgery (SSRF)
- [Apache Kylin: delete metadata backup path-confinement bypass](https://agentprime.io/advisories/CVE-2026-108762.md)
  `CVE-2026-108762` · CVE record: Apache Software Foundation Apache Kylin · CVSS 7.3 High · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-111398.md)
  `CVE-2026-111398` · CVE record: PT Norther Lights Production MapSVG · CVSS 7.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal
- [Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration](https://agentprime.io/advisories/CVE-2026-112051.md)
  `CVE-2026-112051` · CVE record: xorbitsai inference · CVSS 8.3 High · Not analysed yet · Published 18 Oct 2026 · Tags: Path traversal
- [Vita3K before build 4187 Path Traversal via VPK Package Installation](https://agentprime.io/advisories/CVE-2026-112049.md)
  `CVE-2026-112049` · CVE record: Vita3K Vita3K · CVSS 6.7 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Path traversal
- [Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd](https://agentprime.io/advisories/CVE-2026-112015.md)
  `CVE-2026-112015` · CVE record: omnigent-ai omnigent · CVSS 7.7 High · Not analysed yet · Published 18 Oct 2026 · Tags: Path traversal
- [WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor](https://agentprime.io/advisories/CVE-2026-112005.md)
  `CVE-2026-112005` · CVE record: clidey whodb · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: Path traversal
- [weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter](https://agentprime.io/advisories/CVE-2026-110253.md)
  `CVE-2026-110253` · CVE record: boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress · CVSS 5.4 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Path traversal
- [Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments](https://agentprime.io/advisories/CVE-2026-104246.md)
  `CVE-2026-104246` · CVE record: Unknown Contact Form 7 Signature Addon · CVSS 5.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Path traversal
- [Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter](https://agentprime.io/advisories/CVE-2026-110268.md)
  `CVE-2026-110268` · CVE record: wpazleen Post Export Import with Media · CVSS 4.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Path traversal
- [Path traversal in Tektronix 3 Series MDO](https://agentprime.io/advisories/CVE-2026-111855.md)
  `CVE-2026-111855` · CVE record: Tektronix 3 Series MDO · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2026 · Tags: Path traversal
- [Path traversal in Tektronix 3 Series MDO](https://agentprime.io/advisories/CVE-2026-111854.md)
  `CVE-2026-111854` · CVE record: Tektronix 3 Series MDO · CVSS 8.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Path traversal
- [Nautilus: nautilus: arbitrary file deletion via trash symlink](https://agentprime.io/advisories/CVE-2026-111802.md)
  `CVE-2026-111802` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [ClickMigrate has Path Traversal in "revision -m" argument](https://agentprime.io/advisories/GHSA-vgf9-9mxx-hq54.md)
  `GHSA-vgf9-9mxx-hq54`, `CVE-2026-68549` · PyPI `clickmigrate`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 3.3 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal
- [Helical Insight through 7.0.0 Path Traversal via /getExternalResource](https://agentprime.io/advisories/CVE-2026-111635.md)
  `CVE-2026-111635` · CVE record: helicalinsight helicalinsight · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTEwLTE2VDE3OjM5OjA3LjU3MTAwMFoiLCJDVkUtMjAyNi0xMTE2MzUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTEwLTIxVDAwOjE1OjIyLjUyMTAwMFoiLCJDVkUtMjAyNi0xMTM3MzciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTEwLTIxVDAwOjE1OjIyLjUyMTAwMFoiLCJDVkUtMjAyNi0xMTM3MzciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.