Path traversal.

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

• lomart.fr UP plugin for Joomla
• Path traversal
• Broken access control

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

• lomart.fr UP plugin for Joomla
• Path traversal
• Broken access control

Froxlor before 2.3.12 Privilege Escalation via Symlink

• froxlor
• Path traversal

Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

• froxlor
• Path traversal

Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

• kyverno
• Path traversal

Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

• hugo
• Path traversal

Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

• hugo
• Path traversal

Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

• budibase server
• Path traversal

SiYuan before v3.8.4 Path Traversal via setNotebookIcon

• siyuan
• Path traversal

SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID

• siyuan
• Path traversal

SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder

• siyuan
• Path traversal

OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames

• OpenClaw
• Path traversal

OpenClaw before 2026.8.1 Path Traversal via Structured Attachments

• OpenClaw
• Path traversal

OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback

• OpenClaw
• Path traversal

Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

• crivion Laranode
• Path traversal

gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink

• gitoxide
• Path traversal

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

• Path traversal

>=2.0.0-beta.23, <2.0.0-beta.25 · fixed in 2.0.0-beta.25

ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php

• MacWarrior clipbucket-v5
• Path traversal

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

• Path traversal
• Authentication bypass

<0.30.0 · fixed in 0.30.0

GLPI: RCE via Form import

• glpi
• Path traversal

GLPI: arbitrary file deletion

• glpi
• Path traversal

Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

• zammad
• Path traversal

Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

• zammad
• Path traversal

InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

• InvoicePlane
• Path traversal
• File inclusion

InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier

• InvoicePlane
• Path traversal
• File inclusion

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Path traversal

Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request

• Zimbra Collaboration Suite (ZCS)
• Path traversal
• Broken access control

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Path traversal

Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory

• Kovid Goyal kitty
• Path traversal

SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter

• sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects
• Path traversal

Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter

• Link Library
• Path traversal

Path traversal in Netgate pfSense Plus and others

• Netgate pfSense Plus
• Netgate pfSense CE
• Path traversal

copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers

• 9001 copyparty
• Path traversal
• CWE-424

Botslab G980H Dashcams Improper Limitation of a Pathname to a Restricted Directory

• Botslab G980H
• Path traversal

chonkie-inc littrs lib.rs mount path traversal

• chonkie-inc littrs
• Path traversal

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

• Path traversal

<3.12.4 || >=4.0.0, <4.1.0 · fixed in 3.12.4, 4.1.0

langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

• Path traversal

<1.4.2 · fixed in 1.4.2

YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal

• YunaiV ruoyi-vue-pro
• zhijiantianya ruoyi-vue-pro
• Path traversal

Docmost: Public image fileName path traversal leads to unauthorized local file read

• docmost
• Path traversal

Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface

• Honeywell PD45 Industrial Printer
• Path traversal
• Command injection

Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion

• docmost
• Path traversal

volotat Anagnorisis page.html start_streaming path traversal

• volotat Anagnorisis
• Path traversal

Discourse: Reject literal backslash path separators in iframe src traversal guard

• discourse
• Path traversal

DbGate files-style Endpoint files.js fs.readFile path traversal

• DbGate
• Path traversal

Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

• Path traversal

<8.6.0 · fixed in 8.6.0

Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Ansible Automation Platform 2.6
• Path traversal

DataStage on Cloud Pak for Data has several vulnerabilities

• IBM DataStage on Cloud Pak for Data
• Path traversal

DataStage on Cloud Pak for Data has several vulnerabilities

• IBM DataStage on Cloud Pak for Data
• Path traversal

IBM ContextForge MCP Gateway is affected by path traversal

• IBM ContextForge MCP Gateway
• Path traversal

Path Traversal in HAVELSAN's Liman MYS

• HAVELSAN Inc. Liman MYS
• Path traversal

Path Traversal in DIAEnergie

• Deltaww DIAEnergie
• Path traversal

eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter

• eesywp eesy_ID2WP – Publish InDesign HTML5
• Path traversal

PaperCut NG/MF: Remote Code Execution via Scan2Fax

• PaperCut NG/MF
• Path traversal
• Command injection

MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget

• MasterStudy LMS WordPress Plugin
• Path traversal

yhx070424 ShopXO Ueditor Upload ueditor.php path traversal

• yhx070424 ShopXO
• Path traversal

MantisZip Preview MainWindow.UI.cs Path.Combine path traversal

• MantisZip
• Path traversal

weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal

• weiqingwen spring-boot-forum
• Path traversal

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

• Red Hat OpenShift Container Platform 4.12
• Red Hat OpenShift Container Platform 4.13
• Path traversal

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• Path traversal

RabbitMQ: Admin path-traversal write via trace name

• rabbitmq-server
• Path traversal