Path traversal.

knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

• knowns
• Path traversal

WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

• Studio Wombat Advanced Product Fields Extended for WooCommerce
• Path traversal

WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

• Youzify
• Path traversal

WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability

• Adrian Tobey Groundhogg
• Path traversal

proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal

• Proma
• Path traversal

ICEcoder through 8.1 Path Traversal via oldFileName Parameter

• ICEcoder
• Path traversal

ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

• ICEcoder
• Path traversal
• CWE-697

LFI in GIS Informatics' GisLab Laboratory Management System

• GIS Informatics GisLab Laboratory Management System
• Path traversal

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4

• joomshaper.com SP Property extension for Joomla
• Path traversal

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

• containers crun
• Red Hat Hardened Images
• Path traversal

GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink Creation

• GeoVision Inc. GV-LPC2011/LPC2211
• Path traversal

Apache FreeMarker template loading mechanism vulnerable to path traversal

• Path traversal

>=2.2.0, <2.3.35 · fixed in 2.3.35

Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment

• kamalyon Direct Download for WooCommerce
• Path traversal

WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter

• cssimmon WP BackItUp Community Edition
• Path traversal

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.

• Path traversal

@openhop/server: Path Traversal in Flow ID File Operations

• Path traversal

<0.3.6 · fixed in 0.3.6

Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

• pandora
• Path traversal

Path Traversal in Fortra's GoAnywhere MFT Endpoint

• Fortra GoAnywhere MFT
• Path traversal

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

• Path traversal

<1.1.8 · fixed in 1.1.8

LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

• Path traversal

<2.4.1 · fixed in 2.4.1

knowns before 0.30.0 Path Traversal via Document API

• knowns
• Path traversal

Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

• grokability snipe-it
• Path traversal

Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

• grokability snipe-it
• Path traversal

Chainlit through 2.12.0 Path Traversal via socket.io sessionId

• chainlit
• Path traversal

Path traversal in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Path traversal

External control of a file path in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Path traversal

Path traversal in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Path traversal

SiYuan before v3.8.2 Path Traversal via removeRiffDeck

• siyuan
• Path traversal

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.16
• Path traversal

Ragic｜Enterprise Cloud Database - Arbitrary File Read

• Ragic Enterprise Cloud Database
• Path traversal

Path traversal in Samsung Mobile Devices

• Samsung Mobile Devices
• Path traversal

Path traversal in Samsung Mobile Devices

• Samsung Mobile Devices
• Path traversal

Tanium addressed a path traversal vulnerability in Comply.

• Tanium Comply
• Path traversal

Tanium addressed a path traversal vulnerability in Comply.

• Tanium Comply
• Path traversal

Tanium addressed a path traversal vulnerability in Tanium Data Service.

• Tanium Data Service
• Path traversal

ntp: write path traversal

• opnsense core
• Path traversal

OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree

• Path traversal

<=1.15.0 · no fixed version yet

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

• Path traversal

<4.13.5 · fixed in 4.13.5

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

• Path traversal
• Server-side request forgery (SSRF)

<9.1.1 · fixed in 9.1.1

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

• Path traversal

>=13.4.0, <15.5.24 || >=16.0.0, <16.3.3 · fixed in 15.5.24, 16.3.3

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

• Path traversal

>=2.1.0, <4.1.11 || >=5.0.0-beta.1, <5.0.0-rc.2 · fixed in 4.1.11, 5.0.0-rc.2

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

• Path traversal

>=3.1.8, <3.1.70 · fixed in 3.1.70

Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal

• Okta Verify for Windows
• Path traversal

Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling

• Okta Access Gateway
• Path traversal

Improper Path Validation in Okta Access Gateway Backup and Restore Functionality

• Okta Access Gateway
• Path traversal

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

• Path traversal
• Command injection

<3.1.59 · fixed in 3.1.59

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

• Path traversal

<3.1.59 · fixed in 3.1.59

GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

• Path traversal
• Information disclosure

<3.1.59 · fixed in 3.1.59

Skype for Business Remote Code Execution Vulnerability

• Microsoft Skype for Business Server 2015 CU13
• Microsoft Skype for Business Server 2019 CU8
• Path traversal

Infracost: Arbitrary file read via config-template readFile symlink traversal

• Path traversal

<0.10.45 · fixed in 0.10.45

Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

• Adobe Commerce
• Adobe Commerce B2B
• Path traversal

Photoshop Mobile | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

• Adobe Photoshop Android
• Path traversal

Microsoft Word Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 365 for Mac
• Path traversal

Windows Update Stack Elevation of Privilege Vulnerability

• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 24H2
• Path traversal
• Broken access control

Microsoft Power Automate Desktop Elevation of Privilege Vulnerability

• Microsoft Power Automate agent for virtual desktops
• Microsoft Power Automate for Desktop
• Path traversal

.NET Elevation of Privilege Vulnerability

• Microsoft Visual Studio 2022 version 17.14
• Microsoft Visual Studio 2026 version 18.9
• Path traversal
• Information disclosure

Microsoft Windows Search Component Elevation of Privilege Vulnerability

• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 24H2
• Path traversal

PowerShell Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Path traversal