Path traversal.

CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints

• CoAI
• Path traversal

countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

• countly-server
• Path traversal

countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion

• countly-server
• Path traversal

Thermo Fisher Torrent Suite Software Path Traversal

• Thermo Fisher Torrent Suite Software
• Path traversal

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb

• ikus-soft rdiffweb
• Path traversal

10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path

• 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
• Path traversal

Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter

• Tainacan
• Path traversal

Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Path traversal

Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>

• asadkn Debloat – Remove Unused CSS, Optimize JS
• Path traversal

Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Path traversal

Microsoft Office SharePoint Remote Code Execution Vulnerability

• Microsoft SharePoint Server Subscription Edition
• Path traversal

EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

• EnergizeLab station-middleware
• Path traversal

EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write

• EnergizeLab FastAPI AI inference server
• Path traversal
• Unrestricted file upload

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

• Path traversal

<7.2.6 · fixed in 7.2.6

copyparty FTP: upload outside defined volumes (limited path traversal)

• Path traversal

<1.20.19 · fixed in 1.20.19

Nginx UI: Auto backup name allows path traversal outside validated storage path

• Path traversal

<1.9.10-0.20260715121709-f92218e01054 · fixed in 1.9.10-0.20260715121709-f92218e01054

borg extract might modify out-of-tree files when extracting maliciously crafted archives

• Path traversal

<1.4.5 || >=2.0.0b1, <2.0.0b22 · fixed in 1.4.5, 2.0.0b22

SimplePie through 1.9.0 Local File Read via file:// Redirect

• simplepie
• Path traversal

Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL

• Netgate pfSense CE
• Path traversal

Terragrunt catalog predictable temp symlink clobber

• Path traversal
• CWE-377

<1.1.1 · fixed in 1.1.1

GitHub CLI allows path traversal through unescaped request URL components

• Path traversal

<2.97.0 · fixed in 2.97.0

OpenPrinting CUPS: root-side banner file disclosure

• OpenPrinting cups
• Path traversal

CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

• OpenPrinting cups
• Path traversal
• CWE-377

Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

• Lychee
• Path traversal

Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name

• Red Hat JBoss Enterprise Application Platform 8.1
• Red Hat Fuse 7
• Path traversal

Path traversal in JetBrains Datalore

• JetBrains Datalore
• Path traversal

OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files

• opnsense core
• Path traversal

OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

• opnsense core
• Path traversal
• Command injection

EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and delete

• espocrm
• Path traversal

CVE-2026-110746

• TotalSecurity TotalAV
• Path traversal

Path traversal via logging configuration in P4Search

• Perforce P4 (Helix core)
• Path traversal

Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name

• PeaZip
• Path traversal
• CWE-693

Unauthenticated remote code execution vulnerability

• QNAP Systems Inc. Qsirch
• Path traversal

Path Traversal in Virtualization Station VM Import

• QNAP Systems Inc. Virtualization Station
• Path traversal

WebSocket timelapse path traversal and command injection

• QNAP Systems Inc. QuMagie
• Path traversal
• Command injection

Remote Code Execution in upload.php of Video Station

• QNAP Systems Inc. Video Station
• Path traversal

Arbitrary Folder Deletion in Qsync Central 5.0.0.5

• QNAP Systems Inc. Qsync Central
• Path traversal

Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint

• QNAP Systems Inc. QcalAgent
• Path traversal

Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter

• QNAP Systems Inc. Download Station
• Path traversal

Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi

• QNAP Systems Inc. Qsync Central
• Path traversal

Remote code execution via command injection

• QNAP Systems Inc. Video Station
• Path traversal

Arbitrary file deletion and remote code execution

• QNAP Systems Inc. Video Station
• Path traversal

Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.

• Path traversal
• Information disclosure

FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root

• error311 FileRise
• Path traversal

FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs

• error311 FileRise
• Path traversal

Checkov by Prisma Cloud: Path Traversal Vulnerabilities

• Palo Alto Networks Checkov by Prisma Cloud
• Path traversal

FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root

• error311 FileRise
• Path traversal

FileRise Shared Folder Symlink Escape

• error311 FileRise
• Path traversal

Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation

• shd101wyy vscode-markdown-preview-enhanced
• Path traversal

Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion

• coderamp-labs gitingest
• Path traversal

Colanode Server through 0.4.7 Path Traversal via Avatar Download Route

• colanode
• Path traversal

cemtan sar2html File Upload sar2html.py updateDb path traversal

• cemtan sar2html
• Path traversal

dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

• dbt-labs dbt-core
• Path traversal
• Information disclosure

Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members

• ludwig
• Path traversal

F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath

• nasa fprime
• Path traversal

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

• Cisco Secure Email
• Path traversal

Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename

• meetecho janus-gateway
• Path traversal

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label

• Khronos Group nnef
• Khronos Group nnef-tools
• Path traversal

Gitea Org-mode file disclosure and code execution

• Gitea
• Path traversal

Path traversal in Dell Unisphere for PowerMax vApp

• Dell Unisphere for PowerMax vApp
• Path traversal