Path traversal.

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

• Path traversal

<0.0.0-20260704035520-68cc0f537dfa · fixed in 0.0.0-20260704035520-68cc0f537dfa

RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX

• Progress Software Telerik UI for ASP.NET AJAX
• Path traversal

SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field

• bdthemes SigmaForms Pro – AI Generated Forms
• Path traversal

MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal

• MapQuest Get Directions App
• Path traversal

WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter

• JoomUnited WP File Download
• Path traversal

Piwigo Image Derivative i.php path traversal

• Piwigo
• Path traversal

AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal

• AirAsia MOVE App
• Path traversal

facefusion before 3.7.0 Path Traversal via Job Identifier

• facefusion
• Path traversal

WWBN AVideo Unauthenticated Arbitrary Log File Deletion

• WWBN AVideo
• Path traversal

Authenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CX

• Hewlett Packard Enterprise (HPE) AOS-CX
• Path traversal

Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX

• Hewlett Packard Enterprise (HPE) AOS-CX
• Path traversal

Authenticated Path Traversal Vulnerability Leads to Remote Unauthorized Access to Files in AOS-CX

• Hewlett Packard Enterprise (HPE) AOS-CX
• Path traversal

Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX

• Hewlett Packard Enterprise (HPE) AOS-CX
• Path traversal

Unauthenticated Path Traversal in HPE Networking Fabric Composer API Endpoint Allows Unauthorized File Modification

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Path traversal

Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Path traversal

Authenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Path traversal

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

• Elastic Kibana
• Path traversal

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

• Path traversal

>=12.0.0-alpha.0, <12.0.0-alpha.5 · fixed in 12.0.0-alpha.5

Path traversal in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Path traversal

appium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch

• argneshu appium-mcp-server
• Path traversal

Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service

• Elastic Security
• Path traversal

Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

• shabti Frontend Admin by DynamiApps
• Path traversal

Path traversal in Sage Employee Self Service

• Sage Employee Self Service
• Path traversal

Backblaze Client for Windows Improper Link Resolution Vulnerability

• Backblaze Client
• Path traversal

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

• Path traversal

<4.9.5 || >=5.0.0, <5.5.2 · fixed in 4.9.5, 5.5.2

Dokploy Settings application.ts writeTraefikConfigInPath path traversal

• Dokploy
• Path traversal

Wallos: Zip Slip path traversal in database restore writes files to webroot

• ellite Wallos
• Path traversal

Path traversal in Eclipse Foundation Eclipse Theia

• Eclipse Foundation Eclipse Theia
• Path traversal

Apache Wicket: Path traversal in resource style/variation/locale

• Apache Software Foundation Apache Wicket
• Path traversal

ILIAS Arbitrary File Read via SOAP addFile

• ILIAS
• Path traversal

Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

• Path traversal

<=9.0.0 · no fixed version yet

yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal

• yaojingang GEOFlow
• Path traversal

Path traversal in AshAdmin file uploads via unsanitized client filename

• Path traversal

>=0.13.7, <1.3.1 · fixed in 1.3.1

SeaCMS Comment Cache member.php del_pl path traversal

• SeaCMS
• Path traversal

SeaCMS Avatar Upload member.php unlink path traversal

• SeaCMS
• Path traversal

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo…

• Path traversal

AJCloud AJY IPC Firmware Path Traversal via jdbhttpd

• AJCloud AJY IPC Firmware
• Path traversal

Admidio before 5.0.12 Path Traversal via Photo ZIP Download

• admidio
• Path traversal

browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

• browser-use web-ui
• Path traversal

Pake arbitrary file write via unsanitized download_file filename

• tw93 Pake
• Path traversal

WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore

• WPvivid — Backup, Migration & Staging
• Path traversal

Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown

• coderaiser cloudcmd
• Path traversal

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

• Path traversal

<0.0.0-20260612000715-b44cf51fe931 · fixed in 0.0.0-20260612000715-b44cf51fe931

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

• IBM Langflow OSS
• Path traversal

Path traversal in the aws:downloadContent plugin in amazon-ssm-agent

• amazon-ssm-agent
• Path traversal

Snipe-IT vulnerable to directory traversal in displaySig

• Path traversal

<8.5.0 · fixed in 8.5.0

Snipe-IT has a path traversal vulnerability via CSV import `image` field

• Path traversal

<8.6.2 · fixed in 8.6.2

Microsoft Edge (Chromium-based) Spoofing Vulnerability

• Microsoft Edge (Chromium-based)
• Microsoft Edge for Android
• Path traversal

Yamcs has Unauthenticated Directory Traversal

• Path traversal

<5.12.0 · fixed in 5.12.0

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

• Path traversal

<2.60.1 · fixed in 2.60.1

gpt-crawler Arbitrary File Write via outputFileName Parameter

• BuilderIO gpt-crawler
• Path traversal

Qwen-Agent Arbitrary File Read via Caller-Supplied Document Path

• QwenLM Qwen-Agent
• Path traversal

Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths

• gilbertchen duplicacy
• Path traversal

KubeVela Terraform remote loader DoS via unbounded file read

• Path traversal
• Denial of service

<1.9.14 || >=1.10.0-alpha.1, <1.10.9 || >=1.11.0-alpha.1, <1.11.0-alpha.4 · fixed in 1.9.14, 1.10.9, 1.11.0-alpha.4

houtini-ai houtini-lm code_task_files index.ts path traversal

• houtini-ai houtini-lm
• Path traversal

iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal

• iswalle getnote-mcp
• Path traversal

gitoxide before 0.33.0 Path Traversal via symlink following

• gitoxide
• Path traversal

Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read

• shared-files-pro
• Path traversal

Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal

• Shared Files
• shared-files-pro
• Path traversal

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation.

• Path traversal