# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SABnzbd: Orphan-job path traversal permits arbitrary file deletion](https://agentprime.io/advisories/CVE-2026-62965.md)
  `CVE-2026-62965` · CVE record: sabnzbd sabnzbd · CVSS 7.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read](https://agentprime.io/advisories/CVE-2026-119343.md)
  `CVE-2026-119343` · CVE record: Stirling-Tools Stirling-PDF · CVSS 6.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass](https://agentprime.io/advisories/CVE-2026-119342.md)
  `CVE-2026-119342` · CVE record: Stirling-Tools Stirling-PDF · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Server-side request forgery (SSRF), CWE-20, CWE-610
- [Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink](https://agentprime.io/advisories/CVE-2026-119336.md)
  `CVE-2026-119336` · CVE record: pi-hole pi-hole · CVSS 7.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, CWE-61
- [Pi-hole: file:// adlist read check and curl can resolve different files](https://agentprime.io/advisories/CVE-2026-119334.md)
  `CVE-2026-119334` · CVE record: pi-hole pi-hole · CVSS 2.2 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check](https://agentprime.io/advisories/CVE-2026-116250.md)
  `CVE-2026-116250` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.3 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Race condition
- [pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory](https://agentprime.io/advisories/CVE-2026-116249.md)
  `CVE-2026-116249` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked](https://agentprime.io/advisories/CVE-2026-116240.md)
  `CVE-2026-116240` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Race condition
- [Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service](https://agentprime.io/advisories/CVE-2026-119328.md)
  `CVE-2026-119328` · CVE record: immich-app immich · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-115604.md)
  `CVE-2026-115604` · CVE record: Brainstorm Force SureDash · CVSS 5.0 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability](https://agentprime.io/advisories/CVE-2026-39734.md)
  `CVE-2026-39734` · CVE record: Saad Iqbal WP EasyPay · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [LM Studio before 0.4.22+1 Path Traversal via Model Downloader](https://agentprime.io/advisories/CVE-2026-119979.md)
  `CVE-2026-119979` · CVE record: Element Labs LM Studio · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [gettext: Directory traversal via the LANGUAGE environment variable](https://agentprime.io/advisories/CVE-2026-84243.md)
  `CVE-2026-84243` · CVE record: The GNU C Library glibc · CVSS 7.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter](https://agentprime.io/advisories/CVE-2026-104739.md)
  `CVE-2026-104739` · CVE record: rabilal JS Help Desk – AI-Powered Support & Ticketing System · CVSS 4.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive](https://agentprime.io/advisories/CVE-2026-119298.md)
  `CVE-2026-119298` · CVE record: schollz croc · CVSS 4.2 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory](https://agentprime.io/advisories/CVE-2026-119291.md)
  `CVE-2026-119291` · CVE record: zuke-build zuke · CVSS 5.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp](https://agentprime.io/advisories/CVE-2026-119704.md)
  `CVE-2026-119704` · CVE record: BastilleBSD bastille · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)](https://agentprime.io/advisories/CVE-2026-61738.md)
  `CVE-2026-61738` · CVE record: socfortress CoPilot · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Unrestricted file upload
- [CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup](https://agentprime.io/advisories/CVE-2026-118990.md)
  `CVE-2026-118990` · CVE record · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, CWE-379
- [CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route](https://agentprime.io/advisories/CVE-2026-118988.md)
  `CVE-2026-118988` · CVE record · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node](https://agentprime.io/advisories/CVE-2026-119557.md)
  `CVE-2026-119557` · CVE record: n8n-io n8n · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal](https://agentprime.io/advisories/CVE-2026-119553.md)
  `CVE-2026-119553` · CVE record: Moodle Project moodle · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo](https://agentprime.io/advisories/CVE-2026-119546.md)
  `CVE-2026-119546` · CVE record: forgejo forgejo · CVSS 6.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass](https://agentprime.io/advisories/CVE-2026-119364.md)
  `CVE-2026-119364` · CVE record: ProFTPD Project ProFTPD · CVSS 6.0 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata](https://agentprime.io/advisories/CVE-2026-5461.md)
  `CVE-2026-5461` · CVE record: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274](https://agentprime.io/advisories/CVE-2026-118561.md)
  `CVE-2026-118561` · CVE record: Drupal Single Content Sync · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [Symlink following in Apple Xcode](https://agentprime.io/advisories/CVE-2026-112605.md)
  `CVE-2026-112605` · CVE record: Apple Xcode · CVSS 3.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a cr…](https://agentprime.io/advisories/CVE-2026-117183.md)
  `CVE-2026-117183` · CVE record · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [Path traversal in Veeam Management Pack for Microsoft System Center](https://agentprime.io/advisories/CVE-2026-107239.md)
  `CVE-2026-107239` · CVE record: Veeam Management Pack for Microsoft System Center · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key](https://agentprime.io/advisories/CVE-2026-61576.md)
  `CVE-2026-61576` · CVE record: lightdash lightdash · CVSS 8.3 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [External control of a file path in Ubiquiti Inc WiFiman Desktop](https://agentprime.io/advisories/CVE-2026-119250.md)
  `CVE-2026-119250` · CVE record: Ubiquiti Inc WiFiman Desktop · CVSS 7.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Nomad allocation data migration may allow host directory permission modification via symlink following](https://agentprime.io/advisories/CVE-2026-119168.md)
  `CVE-2026-119168` · CVE record: HashiCorp Nomad and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Nomad dispatch payload writes can escape the allocation directory through symlinks](https://agentprime.io/advisories/CVE-2026-107347.md)
  `CVE-2026-107347` · CVE record: HashiCorp Nomad and 1 more · CVSS 8.4 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.](https://agentprime.io/advisories/GHSA-hjqx-j4rw-g7xv.md)
  `GHSA-hjqx-j4rw-g7xv`, `CVE-2026-115908` · crates.io `zip`: affected `>=7.2.0, <9.0.0`, fixed in `9.0.0` · CVSS 7.4 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal, CWE-61
- [Keycloak vulnerable to information disclosure through arbitrary filesystem path probing](https://agentprime.io/advisories/GHSA-9jrw-8xf7-xqhq.md)
  `GHSA-9jrw-8xf7-xqhq`, `BIT-keycloak-2026-9083`, `CVE-2026-9083` · Maven `org.keycloak:keycloak-services`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 4.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source](https://agentprime.io/advisories/CVE-2026-118758.md)
  `CVE-2026-118758` · CVE record: kubeflow pipelines · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload](https://agentprime.io/advisories/CVE-2026-119145.md)
  `CVE-2026-119145` · CVE record: frappe frappe · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90871.md)
  `CVE-2026-90871` · CVE record: Progress Software WS_FTP Server · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Virtual Folder Path Confinement Bypass in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90866.md)
  `CVE-2026-90866` · CVE record: Progress Software WS_FTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal, Unrestricted file upload
- [Host Administrator Path Containment Bypass in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90864.md)
  `CVE-2026-90864` · CVE record: Progress Software WS_FTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal, Unrestricted file upload
- [Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-84294.md)
  `CVE-2026-84294` · CVE record: Progress Software WS_FTP Server · CVSS 7.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-77819.md)
  `CVE-2026-77819` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104309.md)
  `CVE-2026-104309` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104312.md)
  `CVE-2026-104312` · CVE record: IBM Langflow OSS · CVSS 3.5 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Adobe Digital Editions | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2026-113576.md)
  `CVE-2026-113576` · CVE record: Adobe Adobe Digital Editions · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-110190.md)
  `CVE-2026-110190` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-110244.md)
  `CVE-2026-110244` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Path Traversal in Szafir](https://agentprime.io/advisories/CVE-2026-93571.md)
  `CVE-2026-93571` · CVE record: Krajowa Izba Rozliczeniowa Szafir · CVSS 2.3 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter](https://agentprime.io/advisories/CVE-2026-80067.md)
  `CVE-2026-80067` · CVE record: Stylemix MasterStudy LMS WordPress Plugin · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification](https://agentprime.io/advisories/CVE-2026-115713.md)
  `CVE-2026-115713` · CVE record: Elastic Elastic Cloud Enterprise · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss](https://agentprime.io/advisories/CVE-2026-115709.md)
  `CVE-2026-115709` · CVE record: Elastic Elastic Cloud Enterprise · CVSS 8.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass](https://agentprime.io/advisories/CVE-2026-115708.md)
  `CVE-2026-115708` · CVE record: Elastic Elastic Cloud Enterprise · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Path Traversal in BMC ITSM](https://agentprime.io/advisories/CVE-2026-113692.md)
  `CVE-2026-113692` · CVE record: BMC BMC IT Service Management Suite · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal](https://agentprime.io/advisories/CVE-2026-113617.md)
  `CVE-2026-113617` · CVE record: Unknown Automated Import Products to Cart · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46).](https://agentprime.io/advisories/CVE-2026-51912.md)
  `CVE-2026-51912` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129).](https://agentprime.io/advisories/CVE-2026-51863.md)
  `CVE-2026-51863` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file.](https://agentprime.io/advisories/CVE-2026-51851.md)
  `CVE-2026-51851` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.](https://agentprime.io/advisories/CVE-2026-107053.md)
  `CVE-2026-107053` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Backstage catalog rules can be bypassed for URL locations using encoded path segments](https://agentprime.io/advisories/GHSA-w658-mh9p-ww8f.md)
  `GHSA-w658-mh9p-ww8f`, `CVE-2026-115923` · npm `@backstage/plugin-catalog-backend`: affected `<3.9.2 || >=4.0.0, <4.0.2`, fixed in `3.9.2`, `4.0.2` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal
- [Domoticz: Missing authorization and path traversal in the udevices Lua parser handler](https://agentprime.io/advisories/CVE-2026-75520.md)
  `CVE-2026-75520` · CVE record: domoticz domoticz · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal, Broken access control

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTEwLTI4VDIyOjMwOjU5LjY5MzAwMFoiLCJDVkUtMjAyNi03NTUyMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTEwLTMwVDIyOjEwOjU1LjUyNjAwMFoiLCJDVkUtMjAyNi02MTcyNSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTEwLTMwVDIyOjEwOjU1LjUyNjAwMFoiLCJDVkUtMjAyNi02MTcyNSJd>. Everything for agents: <https://agentprime.io/llms.txt>.