Path traversal.

Dagu MCP DAG specification read bypasses path containment and workspace isolation

• dagu
• Path traversal
• Broken access control

FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

• M66B FairEmail
• Path traversal

LXC: lxc-copy host-context hostname update follows symlink

• lxc
• Path traversal
• CWE-61

KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF

• kurrent-io KurrentDB
• Path traversal
• Server-side request forgery (SSRF)

Code Graph RAG structural tools follow out-of-root symlinks

• vitali87 code-graph-rag
• Path traversal

Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

• vitali87 code-graph-rag
• Path traversal

SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM

• SuiteCRM
• Path traversal

Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

• balbooa.com Gridbox extension for Joomla
• Path traversal

Privileged file deletion in SafeNet Authentication Client SACSrv

• Thalesgroup Safenet Authentication Client Service
• Path traversal
• Race condition

GluonTS arbitrary file write during archive extraction

• AWS gluonts
• Path traversal

MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION

• MariaDB server
• Path traversal

Apache OFBiz: Authenticated Path Traversal in Catalog Image Management

• Apache Software Foundation Apache OFBiz
• Path traversal

Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage

• Apache Software Foundation Apache OFBiz
• Path traversal
• Broken access control

Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services

• Apache Software Foundation Apache OFBiz
• Path traversal
• Broken access control

Apache OFBiz: webtools xmldsdump exports any entity to any path

• Apache Software Foundation Apache OFBiz
• Path traversal
• Broken access control

Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass

• Apache Software Foundation Apache OFBiz
• Path traversal

Path Traversal in Kobikom Telecommunications' Kobikom

• Kobikom
• Path traversal

Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

• Apache Software Foundation Apache Juneau
• Path traversal

Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter

• stylemix Motors – Car Dealership & Classified Listings Plugin
• Path traversal

DeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading run.py override_config path traversal

• DeepGraphLearning KnowledgeGraphEmbedding
• Path traversal

Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument

• kyverno
• Path traversal

Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversal

• Edge0-AI Audio8_TTS
• Path traversal

Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)

• readest
• Path traversal

Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview

• readest
• Path traversal

nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write

• nvm
• Path traversal

Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity

• Alan Health Alan: Health Insurance
• Path traversal

nvm prints the contents of any readable file through a symlinked .nvmrc

• nvm
• Path traversal
• Information disclosure

nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable

• nvm
• Path traversal

Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink

• jan
• Path traversal

IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith

• IBM Watson Speech Services Cartridge
• Path traversal

Comfast CF-WR632AX Multipart webmgnt path traversal

• Comfast CF-WR632AX
• Path traversal

Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File

• romkatv powerlevel10k
• Path traversal

Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle

• solidtime
• Path traversal

Cisco Unified Computing System Central Remote Code Execution Vulnerability

• Cisco Unified Computing System Central Software
• Path traversal

Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

• coder
• Path traversal

Path traversal in plug-in deployment

• Phoenix Contact PLCnext Engineer
• Path traversal

Forged LFT metadata permits arbitrary file read and deletion

• SEPPmail AG SEPPmail Secure Email Gateway (SEG)
• Path traversal

Path Traversal in TÜBİTAK BİLGEM's İmzager

• TÜBİTAK BİLGEM Software Technologies Research Institute İmzager
• Path traversal

WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting

• WPvivid — Backup, Migration & Staging
• Path traversal

WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path

• WPvivid — Backup, Migration & Staging
• Path traversal

Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability

• Quest Foglight for Databases
• Path traversal

Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability

• Quest Foglight for Databases
• Path traversal

Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability

• Quest Foglight for Databases
• Path traversal

Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability

• Quest Foglight for Databases
• Path traversal

Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability

• Quest Foglight for Databases
• Path traversal

Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability

• Quest Foglight for Databases
• Path traversal

Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability

• Quest Foglight for Databases
• Path traversal

Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability

• Quest Foglight for Databases
• Path traversal

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths

• Path traversal

Tanium addressed a path traversal vulnerability in Tanium Data Service.

• Tanium Data Service
• Tanium Interact
• Path traversal

Bake filesystem path entitlements approval can be skipped for path using basename prefix

• Docker Buildx
• Path traversal

Symlink following in Google Chrome

• Google Chrome
• Path traversal

Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace

• anthropics claude-code
• Path traversal
• Race condition

isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)

• isomorphic-git
• Path traversal

isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

• isomorphic-git
• Path traversal

Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export

• yeti
• Path traversal

Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write

• yeti
• Path traversal

zt-zip: ZipUtil.unpack can change file permissions of output directory

• zeroturnaround zt-zip
• Path traversal

zt-zip: Path traversal in fluent API unpack

• zeroturnaround zt-zip
• Path traversal

praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)

• Path traversal

<0.9.1 · fixed in 0.9.1