Path traversal.

Whistle vulnerable to path traversal

• Path traversal

<2.10.3 · fixed in 2.10.3

Duplicate Advisory: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

• Path traversal

<=3.10.2 · no fixed version yet

Duplicate Advisory: NLTK: Corpus Reader Sandbox Bypass

• Path traversal

<=3.10.2 · no fixed version yet

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

• Path traversal

<0.71.1 · fixed in 0.71.1

phpMyFAQ has Potential Authenticated Path Traversal in PDF Export

• Path traversal

>=4.0.0-alpha, <4.1.5 · fixed in 4.1.5

browse-mcp has an arbitrary file write via unconfined download and state paths

• Path traversal

<0.8.2 · fixed in 0.8.2

CVE-2026-19913

• Kaltura HTML5 Video Player, html5lib library
• Path traversal
• CWE-20

CVE-2026-19912

• Kaltura HTML5 Video Player, html5 library
• Path traversal
• CWE-20

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

• Path traversal

<=3.3.10 · no fixed version yet

praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

• Path traversal

<1.6.58 · fixed in 1.6.58

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

• Path traversal

<4.6.58 · fixed in 4.6.58

Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Path traversal

dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal

• dekdee adobe-xd-mcp
• Path traversal

Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint

• crater
• Path traversal

liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal

• TREK
• Path traversal

TYPO3-EXT-SA-2026-017: Path Traversal in extension "Mask" (mask)

• Path traversal

<8.3.12 || >=9.0.0, <9.0.11 · fixed in 8.3.12, 9.0.11

Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)

• Path traversal

>=5.0.0, <5.3.50 || >=5.4.0, <5.7.12 · fixed in 5.3.50, 5.7.12

Path traversal in Sky Co., LTD. SKYSEA Client View and others

• Sky Co., LTD. SKYSEA Client View
• Sky Co., LTD. SKYMEC IT Manager
• Path traversal

peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal

• peerigon unzip-crx
• peerigon unzip-crx-3
• Path traversal

Duplicate Advisory: GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

• Path traversal

<=3.1.58 · no fixed version yet

Duplicate Advisory: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

• Path traversal

<=3.1.58 · no fixed version yet

Duplicate Advisory: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

• Path traversal

<=3.1.58 · no fixed version yet

Duplicate Advisory: Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

• Path traversal

* · no fixed version yet

Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

• Path traversal

* · no fixed version yet

Grav CMS before 2.0.16 Symlink Following via createLockFile

• grav
• Path traversal

Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

• vrana adminer
• Path traversal

Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop

• vrana adminer
• Path traversal

Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write

• vrana adminer
• Path traversal

Cloudreve's remote download file paths can escape the selected destination directory

• Path traversal

<=4.0.0-20260606032813-26b6b1044b02 · no fixed version yet

Faveo Helpdesk Logo SettingsController.php unlink path traversal

• Faveo Helpdesk
• Path traversal

WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability

• Stylemix MasterStudy LMS
• Path traversal

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

• Path traversal
• CWE-20

<=2.9.4 · no fixed version yet

Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

• Path traversal

>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

• Path traversal

>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

• Path traversal

>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile

• DrayTek Corporation VigorSwitch G2540xs
• DrayTek Corporation VigorSwitch P2540xs
• Path traversal

adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

• Path traversal

>=0.5.9, <=0.6.0 · no fixed version yet

Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

• Path traversal

* · no fixed version yet

Awx: project archive extraction allows path traversal file writes

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• Path traversal

RansomLook Arbitrary File Read via Path Traversal in Post screen Field

• ransomlook
• Path traversal

Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

• mercadopago
• Path traversal

WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability

• RadiusTheme, LLC ShopBuilder Pro – Elementor WooCommerce Builder Addons
• Path traversal

WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

• vanquish WooCommerce File Approval
• Path traversal

WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability

• WebRehab Super Forms
• Path traversal

Instance template path traversal allows arbitrary host file write as root

• Canonical LXD
• Path traversal

achorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal

• achorein expo-share-intent
• Path traversal

4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read

• 4MOSAn Security Technology 4MOSAn Management Center
• Path traversal

exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

• exceljs
• Path traversal

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

• GitLab
• Path traversal

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter

• WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
• Path traversal

Duplicate Advisory: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

• Path traversal

<=3.9.3 · no fixed version yet

Duplicate Advisory: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

• Path traversal

>=3.10.0 · no fixed version yet

Duplicate Advisory: Stable FrameNet and NKJP readers parse outside-root XML in 3.9.4

• Path traversal

<=3.9.4 · no fixed version yet

Duplicate Advisory: Security Report: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

• Path traversal

<=3.9.4 · no fixed version yet

Duplicate Advisory: NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

• Path traversal

>=3.10.0 · no fixed version yet

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2

• fabrikar.com Fabrik extension for Joomla
• Path traversal

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2

• fabrikar.com Fabrik extension for Joomla
• Path traversal
• Broken access control

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table....

• Path traversal

>=3.9.4, <3.10.3 · fixed in 3.10.3

SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

• siyuan
• Path traversal

Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive

• Basekick-Labs arc
• Path traversal
• CWE-345