# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes](https://agentprime.io/advisories/CVE-2026-115375.md)
  `CVE-2026-115375` · CVE record: lxc incus · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Mistune before 3.3.0 Arbitrary Local File Read via Include Directive](https://agentprime.io/advisories/CVE-2026-115354.md)
  `CVE-2026-115354` · CVE record: lepture mistune · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Mistune before 3.3.0 Path Traversal via include Directive](https://agentprime.io/advisories/CVE-2026-115353.md)
  `CVE-2026-115353` · CVE record: lepture mistune · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8](https://agentprime.io/advisories/CVE-2026-79866.md)
  `CVE-2026-79866` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory](https://agentprime.io/advisories/CVE-2026-77156.md)
  `CVE-2026-77156` · CVE record: Checkmarx github.com/checkmarx/ast-cli · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [virtualenv: Generated files can follow existing destination links](https://agentprime.io/advisories/GHSA-558c-9hv2-4prj.md)
  `GHSA-558c-9hv2-4prj`, `BIT-virtualenv-2026-113721`, `CVE-2026-113721` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 4.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)](https://agentprime.io/advisories/CVE-2026-114606.md)
  `CVE-2026-114606` · CVE record: jgraph drawio-desktop · CVSS 5.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal, Information disclosure
- [Storybook dev server vulnerable to code injection from the local network](https://agentprime.io/advisories/GHSA-px85-f4q5-jh77.md)
  `GHSA-px85-f4q5-jh77`, `CVE-2026-114126` · npm `storybook` and 5 more: affected `>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6`, fixed in `8.6.19`, `9.1.21`, `10.6.2`, `11.0.0-alpha.6` · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal, Code injection, Authentication bypass, CWE-1188
- [JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore](https://agentprime.io/advisories/CVE-2026-104068.md)
  `CVE-2026-104068` · CVE record: JetBackup JetBackup · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc](https://agentprime.io/advisories/GHSA-pjvx-prjx-h659.md)
  `GHSA-pjvx-prjx-h659`, `CVE-2026-114140` · PyPI `nbconvert`: affected `>=5.4.0, <7.17.2`, fixed in `7.17.2` · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE](https://agentprime.io/advisories/CVE-2026-92709.md)
  `CVE-2026-92709` · CVE record: rsyslog rsyslog · CVSS 8.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId](https://agentprime.io/advisories/CVE-2024-58396.md)
  `CVE-2024-58396` · CVE record: YouDataSum CPAS Audit Management System · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer](https://agentprime.io/advisories/CVE-2022-51025.md)
  `CVE-2022-51025` · CVE record: Penta Security Systems WAPPLES · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint](https://agentprime.io/advisories/CVE-2022-51024.md)
  `CVE-2022-51024` · CVE record: Kareadita Kavita · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint](https://agentprime.io/advisories/CVE-2022-51022.md)
  `CVE-2022-51022` · CVE record: liukuo362573 YiShaAdmin · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi](https://agentprime.io/advisories/CVE-2021-48017.md)
  `CVE-2021-48017` · CVE record: OrbiTeam BSCW Server · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [JeeWMS Path Traversal via showOrDownByurl.do](https://agentprime.io/advisories/CVE-2021-48015.md)
  `CVE-2021-48015` · CVE record: erzhongxmu JeeWMS · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer](https://agentprime.io/advisories/CVE-2021-48014.md)
  `CVE-2021-48014` · CVE record: FanRuan FineReport · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload](https://agentprime.io/advisories/CVE-2021-48013.md)
  `CVE-2021-48013` · CVE record: Weaver Network Co., Ltd. E-cology · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [WooThemes Diarise 1.5.9 Local File Disclosure via download.php](https://agentprime.io/advisories/CVE-2019-25779.md)
  `CVE-2019-25779` · CVE record: WooThemes Diarise · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter](https://agentprime.io/advisories/CVE-2018-25439.md)
  `CVE-2018-25439` · CVE record: MetInfo MetInfo · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Intermesh Group-Office < 3.5.5 Path Traversal via compress.php](https://agentprime.io/advisories/CVE-2018-25438.md)
  `CVE-2018-25438` · CVE record: Intermesh Group-Office · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter](https://agentprime.io/advisories/CVE-2017-20287.md)
  `CVE-2017-20287` · CVE record: Javo Themes Javo Spot · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Patch: filename validation bypass in reversal fallback allows file creation outside the working directory](https://agentprime.io/advisories/CVE-2026-115207.md)
  `CVE-2026-115207` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-112311.md)
  `CVE-2026-112311` · CVE record: ACF Extended ACF Extended · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129](https://agentprime.io/advisories/CVE-2026-81163.md)
  `CVE-2026-81163` · CVE record: Drupal Media Library Importer · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Path traversal in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-114714.md)
  `CVE-2026-114714` · CVE record: Roundcube Webmail · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [virtualenv: Builtin creation follows linked environment directories](https://agentprime.io/advisories/GHSA-cw65-gx24-rc82.md)
  `GHSA-cw65-gx24-rc82`, `BIT-virtualenv-2026-113716`, `CVE-2026-113716` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 4.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [virtualenv: Deletion recovery can change a symlink target's mode](https://agentprime.io/advisories/GHSA-43mp-35q3-x3fq.md)
  `GHSA-43mp-35q3-x3fq`, `BIT-virtualenv-2026-113724`, `CVE-2026-113724` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 4.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion](https://agentprime.io/advisories/CVE-2026-114379.md)
  `CVE-2026-114379` · CVE record: EKKOLearnAI ekko-studio · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal](https://agentprime.io/advisories/CVE-2026-114377.md)
  `CVE-2026-114377` · CVE record: leomoon-studios wiki-go · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [leomoon-studios wiki-go API editor.go SourceHandler path traversal](https://agentprime.io/advisories/CVE-2026-114376.md)
  `CVE-2026-114376` · CVE record: leomoon-studios wiki-go · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix](https://agentprime.io/advisories/GHSA-xp26-3454-mjgp.md)
  `GHSA-xp26-3454-mjgp`, `CVE-2026-112950` · npm `@vitest/mocker`: affected `>=4.1.11, <4.1.12 || >=5.0.0-rc.2, <5.0.3`, fixed in `4.1.12`, `5.0.3` · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal](https://agentprime.io/advisories/CVE-2026-114375.md)
  `CVE-2026-114375` · CVE record: leomoon-studios wiki-go · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition](https://agentprime.io/advisories/CVE-2026-85518.md)
  `CVE-2026-85518` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage](https://agentprime.io/advisories/CVE-2026-105945.md)
  `CVE-2026-105945` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 7.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint](https://agentprime.io/advisories/CVE-2026-114492.md)
  `CVE-2026-114492` · CVE record: flipped-aurora gin-vue-admin · CVSS 7.0 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images](https://agentprime.io/advisories/CVE-2026-114491.md)
  `CVE-2026-114491` · CVE record: bpampuch pdfmake · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites](https://agentprime.io/advisories/GHSA-f2ph-cmg5-wxc8.md)
  `GHSA-f2ph-cmg5-wxc8`, `CVE-2026-114125` · npm `storybook` and 5 more: affected `>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6`, fixed in `8.6.19`, `9.1.21`, `10.6.2`, `11.0.0-alpha.6` · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Code injection, Broken access control, CWE-346
- [djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool](https://agentprime.io/advisories/GHSA-r57g-mc79-8hj2.md)
  `GHSA-r57g-mc79-8hj2`, `CVE-2026-113731` · PyPI `djust`: affected `>=0.9.0, <1.0.10 || >=1.1.0, <1.1.7 || >=1.2.0.dev0, <1.2.4 || >=1.3.0.dev0, <1.3.0rc8`, fixed in `1.0.10`, `1.1.7`, `1.2.4`, `1.3.0rc8` · CVSS 3.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability](https://agentprime.io/advisories/CVE-2026-92205.md)
  `CVE-2026-92205` · CVE record: BusyBox BusyBox · CVSS 6.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Vite: Files outside \`server.fs.allow\` could be served when project paths match system paths on non-Windows machine](https://agentprime.io/advisories/GHSA-rq7h-c2jc-7f22.md)
  `GHSA-rq7h-c2jc-7f22`, `CVE-2026-112946` · npm `vite` and 1 more: affected `<6.4.4 || >=7.0.0, <7.3.7 || >=8.0.0, <8.1.6 || >=8.2.0, <8.2.4 || >=8.3.0, <8.3.3`, fixed in `6.4.4`, `7.3.7`, `8.1.6`, `8.2.4`, `8.3.3` · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Broken access control
- [Vite: First 4 bytes of files outside of \`server.fs\` setting is exposed by \`?vite-wasm-instance\`](https://agentprime.io/advisories/GHSA-vfpm-58rq-9qcg.md)
  `GHSA-vfpm-58rq-9qcg`, `CVE-2026-112947` · npm `vite` and 1 more: affected `>=8.2.0, <8.2.4 || >=8.3.0, <8.3.3`, fixed in `8.2.4`, `8.3.3` · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Information disclosure
- [Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76496.md)
  `CVE-2026-76496` · CVE record: Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 7.0 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76479.md)
  `CVE-2026-76479` · CVE record: Cisco Cisco Emergency Responder and 3 more · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Arbitrary File Read via Symlink in Velneo vServer HTTP Server](https://agentprime.io/advisories/CVE-2026-114462.md)
  `CVE-2026-114462` · CVE record: Velneo vServer · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal](https://agentprime.io/advisories/CVE-2026-114370.md)
  `CVE-2026-114370` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 3.7 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [oretnom23 file-management-system-php index.php include file inclusion](https://agentprime.io/advisories/CVE-2026-114253.md)
  `CVE-2026-114253` · CVE record: oretnom23 file-management-system-php · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-111833.md)
  `CVE-2026-111833` · CVE record: Bold Grid weForms · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload](https://agentprime.io/advisories/CVE-2026-114402.md)
  `CVE-2026-114402` · CVE record: polonel trudesk · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API](https://agentprime.io/advisories/CVE-2026-114399.md)
  `CVE-2026-114399` · CVE record: polonel trudesk · CVSS 7.0 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof](https://agentprime.io/advisories/CVE-2026-86147.md)
  `CVE-2026-86147` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Denial of service
- [DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal](https://agentprime.io/advisories/CVE-2026-114040.md)
  `CVE-2026-114040` · CVE record: DT42 BerryNet · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries](https://agentprime.io/advisories/GHSA-m3wx-qqmx-qxvf.md)
  `GHSA-m3wx-qqmx-qxvf` · PyPI `uv`: affected `*`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal](https://agentprime.io/advisories/CVE-2026-113743.md)
  `CVE-2026-113743` · CVE record: Tenstorrent tt-metal · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints](https://agentprime.io/advisories/CVE-2026-114083.md)
  `CVE-2026-114083` · CVE record: triggerdotdev trigger.dev · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows](https://agentprime.io/advisories/CVE-2026-114063.md)
  `CVE-2026-114063` · CVE record: sveltejs kit · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction](https://agentprime.io/advisories/CVE-2025-71437.md)
  `CVE-2025-71437` · CVE record: astral-sh uv · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal](https://agentprime.io/advisories/CVE-2026-113738.md)
  `CVE-2026-113738` · CVE record: R6410418 Jackrong-llm-finetuning-guide · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [R6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal](https://agentprime.io/advisories/CVE-2026-113737.md)
  `CVE-2026-113737` · CVE record: R6410418 Jackrong-llm-finetuning-guide · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTEwLTIxVDAwOjE1OjIyLjUyMTAwMFoiLCJDVkUtMjAyNi0xMTM3MzciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTEwLTIyVDE5OjEzOjQ2LjMwNTAwMFoiLCJDVkUtMjAyNi0xMTUzNzciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTEwLTIyVDE5OjEzOjQ2LjMwNTAwMFoiLCJDVkUtMjAyNi0xMTUzNzciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.