Path traversal.

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Path traversal

OpenWrt luci-app-bmx7 Path Traversal via bmx7-info

• openwrt luci
• Path traversal

Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read

• Import and export users and customers
• Path traversal

Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

• Path traversal

<5.10.0 · fixed in 5.10.0

Keras: HDF5 links can disclose local file contents

• Path traversal

<3.12.3 || >=3.13.0, <3.15.0 · fixed in 3.12.3, 3.15.0

CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter

• cubewp1211 CubeWP Framework
• Path traversal

User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter

• gm_alex User Access Manager
• Path traversal

Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

• Path traversal

>=3.7.0, <=3.7.7 · no fixed version yet

FreeRDP before 3.29.0 Path Traversal via drive redirection

• FreeRDP
• Path traversal

NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter

• webaways NEX-Forms – Ultimate Forms Plugin for WordPress
• Path traversal

Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)

• themeum Kirki – Freeform Page Builder, Website Builder & Customizer
• Path traversal

HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view

• HUSKY
• Path traversal

Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal

• Support Genix
• Path traversal

Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field

• bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
• Path traversal

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

• Path traversal

<0.0.0-20260608182036-f3f4bbe80cb5 · fixed in 0.0.0-20260608182036-f3f4bbe80cb5

guard-livereload has a directory traversal vulnerability

• Path traversal

<2.5.2 · fixed in 2.5.2

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

• Path traversal
• Information disclosure

>=1.0.0, <1.3.1 · fixed in 1.3.1

Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

• copier
• Path traversal
• CWE-180

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

• Path traversal

<7.8.0 · fixed in 7.8.0

hashi-vault-js has a path traversal and query parameter injection

• Path traversal
• Other injection

<0.5.2 · fixed in 0.5.2

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

• Path traversal

<3.10.0 · fixed in 3.10.0

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

• Path traversal

<3.10.0 · fixed in 3.10.0

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

• Path traversal

<2.6.4 · fixed in 2.6.4

Path traversal in NotebookRepo note and folder path composition

• Apache Software Foundation Apache Zeppelin
• Path traversal

Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

• Apache Software Foundation Apache Kyuubi
• Path traversal
• CWE-27

ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration

• Comfy-Org ComfyUI
• Path traversal

ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read

• Comfy-Org ComfyUI
• Path traversal

RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

• CyberTimon RapidRAW
• Path traversal

Apache Tika: Arbitrary Local File Read in ISArchiveParser

• Apache Software Foundation Apache Tika
• Path traversal

Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints

• IBM Langflow OSS
• Path traversal

Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)

• masci banks
• Path traversal

Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write

• Apache Software Foundation Apache Kyuubi
• Path traversal

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

• Path traversal

<2.26.7 · fixed in 2.26.7

L7 policy bypass via unnormalized HTTP path matching

• Tigera Calico
• Tigera Calico Enterprise
• Path traversal

IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability

• IBM App Connect Enterprise
• Path traversal

IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

• IBM App Connect Enterprise
• Path traversal

vCenter directory-traversal vulnerability

• VMware Cloud Foundation
• VMware vSphere Foundation
• Path traversal

Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts

• Ultimate Addons for WPBakery Page Builder
• Path traversal

Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

A path traversal vulnerability was found in the IHM Log handling of ADM

• ASUSTOR Inc. ADM
• Path traversal

A path traversal vulnerability was found in the Wallpaper component of ADM

• ASUSTOR Inc. ADM
• Path traversal

A path traversal vulnerability was found in the VPN Clients on the ADM

• ASUSTOR Inc. ADM
• Path traversal

Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration

• Linuxfabrik monitoring-plugins
• Path traversal
• Race condition

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.

• Path traversal

<26.2 · fixed in 26.2

DriveLock Directory Traversal Information Disclosure Vulnerability

• DriveLock
• Path traversal

DriveLock Directory Traversal Information Disclosure Vulnerability

• DriveLock
• Path traversal

DriveLock Directory Traversal Information Disclosure Vulnerability

• DriveLock
• Path traversal

DriveLock Directory Traversal Information Disclosure Vulnerability

• DriveLock
• Path traversal

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability

• G DATA Total Security
• Path traversal

Develar's electron-builder allows arbitrary file overwrite

• Develar app-builder
• Path traversal

ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal

• Path traversal

<0.7.0 · fixed in 0.7.0

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

• Path traversal

<0.20.0 · fixed in 0.20.0

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2

• balbooa.com Gridbox extension for Joomla
• Path traversal

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

• balbooa.com Gridbox extension for Joomla
• Path traversal
• Broken access control

remote limited file-write as root via discovery in open-iscsi

• open-iscsi
• Path traversal

Arbitrary Output Location Change in GNU Bison

• GNU Bison
• Path traversal

Vacron｜IP Camera - Arbitrary File Read

• Vacron VIN-DS783E-E6
• Path traversal

Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

• wp-media-folder-addon
• Path traversal

goshs has ACL Bypass & Path Traversal

• Path traversal
• Broken access control

<=1.1.4 · no fixed version yet

Pagy I18n locale option is not validated before being used in a file path

• Path traversal
• Information disclosure

>=43.0.0, <43.5.6 · fixed in 43.5.6