Path traversal.

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

• Path traversal
• CWE-61

>=0.5.0, <0.11.1 · fixed in 0.11.1

openhole-server vulnerable to path traversal via URL-decoded request path

• Path traversal

<0.1.2 · fixed in 0.1.2

goshs has a Path Traversal issue

• Path traversal

<2.1.5-0.20260727065949-f3ef599e4091 · fixed in 2.1.5-0.20260727065949-f3ef599e4091

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

• Path traversal
• Information disclosure

<0.62.0 · fixed in 0.62.0

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

• Path traversal
• Information disclosure

>=0.59.0, <0.62.0 · fixed in 0.62.0

Path Traversal in IBM Desktop App

• IBM Aspera Desktop App
• Path traversal

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

• Path traversal

<1.25.0 · fixed in 1.25.0

IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability

• IBM WebSphere Application Server - Liberty
• Path traversal

SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read

• softaculous SpeedyCache – Cache, Optimization, Performance
• Path traversal

Bridge | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

• Adobe Bridge
• Path traversal

TinyWeb 0.0.8 Path Traversal via URL Path Component

• GeneralSandman TinyWeb
• Path traversal

@wakaru/cli arbitrary file write during bundle unpack

• Path traversal

>=1.0.0, <1.4.0 · fixed in 1.4.0

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

• Mattermost
• Path traversal

Path Traversal in Quick.CMS

• OpenSolution Quick.CMS
• Path traversal

Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter

• wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
• Path traversal

Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action

• deveasel Demi – One Click Demo Import, Backup & Site Migration
• Path traversal

Path traversal in zip-lib

• zip-lib
• Path traversal

Path traversal in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Symlink following in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Path traversal

Potential path traversal leading to unauthorized file writes

• jfrog artifactory
• Path traversal

phpMyFAQ before 4.1.6 Path Traversal via category image deletion

• thorsten phpMyFAQ
• Path traversal

Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass

• Erlang OTP
• Path traversal

Path traversal Vulnerability

• Ericsson Packet Core Controller (PCC)
• Path traversal

NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server

• nitroshare-desktop
• Path traversal

WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability

• Syed Balkhi Easy Digital Downloads
• Path traversal

WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

• Themeum Kirki
• Path traversal

ZJONSSON node-unzipper extract.js Extract path traversal

• ZJONSSON node-unzipper
• Path traversal

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1

• joomshaper.com SP Page Builder extension for Joomla
• Path traversal

Arbitrary Path Execution via CPS URI in proCertum SmartSign

• Asseco proCertum SmartSign
• Path traversal

Path Traversal Vulnerability in ZTE Blade A75 5G

• ZTE Blade A75 5G
• Path traversal

Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1

• phoca.cz Phoca Commander extension for Joomla
• Path traversal

perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

• perwendel spark
• Path traversal
• CWE-61

Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter

• Themehigh Checkout Field Editor for WooCommerce (Pro)
• Path traversal

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

• Path traversal

<4.2.4 · fixed in 4.2.4

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

• Path traversal
• Denial of service

<5.1.2 · fixed in 5.1.2

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

• Path traversal
• Information disclosure

<=3.38.1 · no fixed version yet

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

• Path traversal
• Server-side request forgery (SSRF)

>=0.9.6, <0.10.0 · fixed in 0.10.0

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

• Path traversal

<4.0.0-20260613023150-7968e50429ef · fixed in 4.0.0-20260613023150-7968e50429ef

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

• Path traversal
• Command injection

>=2.1.38, <2.1.163 · fixed in 2.1.163

@fastify/static vulnerable to route guard bypass via path traversal

• Path traversal

<10.1.1 · fixed in 10.1.1

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

• Path traversal

<8.5.18 · fixed in 8.5.18

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

• Path traversal

<11.0.0 · fixed in 11.0.0

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

• Path traversal
• CWE-829

<1.29.1 || >=1.30.0, <1.34.0 · fixed in 1.29.1, 1.34.0

Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

• Path traversal
• Code injection

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

• Path traversal
• Server-side request forgery (SSRF)

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

• Path traversal
• Server-side request forgery (SSRF)

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

• Path traversal
• CWE-829

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

• Path traversal

<1.6.5 · fixed in 1.6.5

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being j...

• Path traversal

<5.0.1 · fixed in 5.0.1

ImageMagick: Policy Bypass in script operation due to missing checks

• Path traversal
• Broken access control

<14.15.0 · fixed in 14.15.0

ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

• Path traversal
• Broken access control

<14.15.0 · fixed in 14.15.0

ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219

• Path traversal
• Race condition

<14.15.0 · fixed in 14.15.0

ImageMagick: Policy Bypass in concatenate operation due to missing checks

• Path traversal
• Broken access control

<14.15.0 · fixed in 14.15.0

Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter

• Loytec LIP-ME20xC
• Loytec L-INX
• Path traversal

Path traversal in Exim

• Exim
• Path traversal

Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter

• posimyththemes Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
• Path traversal