Path traversal.

Symlink following in Lenovo Dock Manager

• Lenovo Dock Manager
• Path traversal

Symlink following in Lenovo Vantage

• Lenovo Vantage
• Path traversal

rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

• rsync
• Path traversal

rsync < 3.5.0 Symlink Race Condition Directory Traversal

• rsync
• Path traversal
• Race condition

rsync < 3.5.0 Symlink Race Condition via --remove-source-files

• rsync
• Path traversal
• Race condition

rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application

• rsync
• Path traversal
• Race condition

rsync < 3.5.0 Symlink Race Condition Information Disclosure

• rsync
• Path traversal
• Race condition

rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling

• rsync
• Path traversal
• Race condition

rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest

• rsync
• Path traversal

rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

• rsync
• Path traversal

rsync < 3.5.0 Path Traversal Write Escape via --relative Mode

• rsync
• Path traversal

rsync < 3.5.0 Path Traversal via Symlink Module Root

• rsync
• Path traversal

rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync

• rsync
• Path traversal
• Command injection

rsync < 3.5.0 Symlink Following Arbitrary File Overwrite

• rsync
• Path traversal

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

• Path traversal

<1.1.0 · fixed in 1.1.0

ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

• Path traversal
• CWE-377

<3.1.0 · fixed in 3.1.0

WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

• LiquidThemes AI Hub
• Path traversal

WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

• Daan.dev OMGF Pro
• Path traversal

WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

• Roland Barker Participants Database
• Path traversal

WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability

• Lasso Analytics, Inc. Do Lasso
• Path traversal

filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink

• filebrowser
• Path traversal

Prisma Access Agent: Authenticated Limited File Deletion on Linux

• Palo Alto Networks Prisma Access Agent
• Path traversal

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

• Path traversal

<2.0.0 · fixed in 2.0.0

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for

• MITHALDU PDF::WebKit
• Path traversal
• Command injection

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

• Red Hat Container Native Virtualization 4.12
• Red Hat Container Native Virtualization 4.13
• Path traversal

rConfig < 8.2.13 Path Traversal File Read via FileDownloadController

• rConfig
• Path traversal

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

• IBM i Access Client Solutions
• Path traversal

Arbitrary file read+write on host via templates/ symlink in malicious image

• Canonical LXD
• Path traversal

Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE

• Canonical LXD
• Path traversal

Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

• Canonical LXD
• Path traversal

Root RCE via image backup.yaml symlink

• Canonical LXD
• Path traversal

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

• Path traversal

<0.0.0-20260526080459-dd1b4287899e · fixed in 0.0.0-20260526080459-dd1b4287899e

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

• i
• Path traversal

IBM i is Affected By Path Traversal Vulnerability in Navigator for i

• i
• Path traversal

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

• i
• Path traversal

WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

• Progress Software Corporation WhatsUp Gold
• Path traversal
• Code injection

WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.

• Progress Software Corporation WhatsUp Gold
• Path traversal
• Unrestricted file upload

SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

• Path traversal

<2026.0.0 · fixed in 2026.0.0

Authenticated users may write data outside the intended Docker cache path

• jfrog artifactory
• Path traversal

Authenticated users may write files outside the intended Artifactory work directory

• jfrog artifactory
• Path traversal

Repository readers may access content outside configured upstream paths

• jfrog artifactory
• Path traversal

Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

• seerr
• Path traversal
• Code injection

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0

• joomshaper.com SP Page Builder extension for Joomla
• Path traversal

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0

• joomshaper.com SP Page Builder extension for Joomla
• Path traversal

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal

• WP Photo Album Plus
• Path traversal

Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation

• Snowflake Python APIs
• Path traversal
• CWE-141

Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation

• cisagov Malcolm
• Path traversal

kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing

• kekingcn kkFileView
• Path traversal

FreeCAD: FCStd path traversal allows arbitrary file write via unsanitized file attribute in PropertyFileIncluded::Restore()

• FreeCAD
• Path traversal

GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

• paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
• Path traversal

Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field

• Strategy11 Formidable Digital Signatures
• Path traversal

DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

• eosphoros-ai DB-GPT
• Path traversal

Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path

• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Red Hat Advanced Cluster Management for Kubernetes 2.14
• Path traversal

DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing

• Stanford NLP DSPy
• Path traversal

electerm's RDP clipboard file download may parse unsafe file name

• electerm
• Path traversal

electerm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename

• electerm
• Path traversal

electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename

• electerm
• Path traversal

XAgent Path Traversal Arbitrary File Read via /workspace/file

• OpenBMB XAgent
• Path traversal

Lightroom Classic | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

• Adobe Lightroom Classic
• Path traversal

Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability

• Microsoft OneDrive for MacOS
• Path traversal