Path traversal.

Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

• Path traversal

>=1.25.1, <1.35.0 · fixed in 1.35.0

lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()

• Uwe Ohse lrzsz
• Path traversal

Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

• rundeck
• Path traversal

WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

• Mitchell Bennis Simple File List
• Path traversal

WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability

• About Piotnet Piotnet Addons For Elementor
• Path traversal

WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability

• BlueGlass Interactive AG Jobs for WordPress
• Path traversal

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java.

• Path traversal

uv: Path traversal on Windows through wheel extraction

• Path traversal

>=0.12.7, <0.12.18 · fixed in 0.12.18

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

• Path traversal

<1.4.2 · fixed in 1.4.2

Nx: Path traversal in nx migrate package-migrations extraction

• Path traversal

>=13.10.0, <22.7.10 || >=23.0.0, <23.2.1 · fixed in 22.7.10, 23.2.1

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

• Path traversal

<=19.2.27 || >=20.0.0, <20.3.36 || >=21.0.0, <21.2.23 || >=22.0.0, <22.1.7 · fixed in 20.3.36, 21.2.23, 22.1.7

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

• Path traversal

>=2.107.0, <2.120.3 · fixed in 2.120.3

Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

• Newell Brands DYMO ID
• Path traversal
• Information disclosure

auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

• cookpete auto-changelog
• Path traversal
• Command injection

Server-side request forgery in Eclipse Foundation Eclipse Che

• Eclipse Foundation Eclipse Che
• Path traversal
• Hard-coded credentials

Arbitrary file read via the convert_playwright_script prompt in mcp-k6

• Grafana mcp-k6
• Path traversal
• CWE-424

Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality

• The Document Foundation LibreOffice
• Path traversal

Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal

• Totolink A3002MU
• Path traversal

Arbitrary file-write via extension installation in P4Search

• Perforce P4 (Helix Core)
• Path traversal

Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

• Mitel MiVoice Office 400
• Path traversal
• CWE-426

Arbitrary file-write via log configuration path in P4Search

• Perforce P4 (Helix Core)
• Path traversal

Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution

• Mitel MiVoice Office 400
• Path traversal
• Unrestricted file upload

Path traversal in Papermerge

• Papermerge
• Path traversal

Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

• Legcord
• Path traversal

Gerapy Project Management views.py project_create path traversal

• Gerapy
• Path traversal

Feehi CMS 2.1.1 is vulnerable to Directory Traversal.

• Path traversal

ApiAdmin v5.0 and before is vulnerable to Directory Traversal.

• Path traversal

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal.

• Path traversal

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local().

• Path traversal

RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal

• RainyGao DocSys
• Path traversal

Drogon Static File Router StaticFileRouter.cc route path traversal

• Drogon
• Path traversal

LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

• laradashboard
• Path traversal

Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal

• Linux Mint Xreader
• Path traversal

Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal

• Linux Mint Xreader
• Path traversal

VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter

• e4jvikwp VikAppointments Services Booking Calendar
• Path traversal

Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter

• Loco Translate
• Path traversal

Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

• Unlimited Elements for Elementor
• Path traversal

MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import

• MPG
• Path traversal

Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

• formwork
• Path traversal

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)

• Path traversal

<0.0.0-20260813142104-b26a4a307b8a · fixed in 0.0.0-20260813142104-b26a4a307b8a

Vibe-Trading file-read tools expose arbitrary server-readable files

• Path traversal
• Information disclosure

>=0.1.0, <0.1.7 · fixed in 0.1.7

Path traversal in aquasec Trivy

• aquasec Trivy
• Path traversal

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

• Path traversal
• Broken access control

>=1.0, <2.2.30 || >=2.3.0, <2.10.3 · fixed in 2.2.30, 2.10.3

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

• Path traversal

<1.2.9 · fixed in 1.2.9

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

• Path traversal
• CWE-61

>=0.24.0, <1.2.8 · fixed in 1.2.8

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

• Path traversal

>=0.23.1, <1.2.8 · fixed in 1.2.8

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

• Path traversal

>=0.22.5, <1.2.8 · fixed in 1.2.8

CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

• Damjan CodeArt Google MP3 Audio Player
• Path traversal

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

• demsking image-downloader
• Path traversal

Logback: Incomplete protection against CVE-2026-19880

• QOS.CH Sarl Logback-classic
• Path traversal

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by…

• Path traversal

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server file…

• Path traversal

Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage_image

• GongRzhe Office-PowerPoint-MCP-Server
• Path traversal

External control of a file path in Johnson Controls EasyIO FS32

• Johnson Controls EasyIO FS32
• Path traversal

Local File Inclusion in Teledyne FLIR Robots running Aware2

• Teledyne FLIR Aware2
• Path traversal

GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field

• GetSimpleCMS-CE
• Path traversal
• File inclusion

Path traversal in Fortinet FortiMail

• Fortinet FortiMail
• Path traversal

Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools

• givanz Vvveb
• Path traversal

Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace

• AWS security-agent-mcp-server
• Path traversal
• Command injection

Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.8
• Path traversal