Path traversal.

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Symlink following in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Path traversal

Path traversal in Apple iOS and iPadOS

• Apple iOS and iPadOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Symlink following in Apple macOS

• Apple macOS
• Path traversal

Path traversal in Apple macOS

• Apple macOS
• Path traversal

Symlink following in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Path traversal

Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape

• Syncplify, Inc. Syncplify Server!
• Path traversal

Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

• Apache Software Foundation Apache SIS
• Path traversal

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

• Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox)
• Path traversal
• Broken access control

Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks

• Webasyst Framework
• Path traversal

A path traversal vulnerability exists in the Mautic Asset API.

• Path traversal

Arbitrary File Read in Innotim Software's Logsign SIEM

• Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM
• Path traversal

PGYER codefever URI Sanitizer doc.php _detail path traversal

• PGYER codefever
• Path traversal

Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

• Apache Software Foundation Apache Camel
• Path traversal

Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory

• Apache Software Foundation Apache Camel
• Path traversal

halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal

• halo
• Path traversal

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.

• Path traversal

Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

• rclone
• Path traversal

Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

• rclone
• Path traversal

SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

• siyuan
• Path traversal

SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool

• siyuan
• Path traversal

Leon before commit 50df142 Path Traversal via /download model Command

• leon
• Path traversal

Paisa before 0.7.8 Path Traversal via Editor and Sheet API

• ananthakumaran paisa
• Path traversal

eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

• eventcatalog sdk
• Path traversal

1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal

• 1999AZZAR designer-mcp
• Path traversal

GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import

• GiveWP
• Path traversal

Path traversal in post media lets any registered user read server files

• GitroomHQ postiz-app
• Path traversal
• Other injection

Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action

• owen2345 camaleon-cms
• Path traversal

GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal

• GeoDirectory
• Path traversal

virtualenv: Seed replacement does not contain metadata deletion paths

• Path traversal

<21.14.9 · fixed in 21.14.9

Arbitrary file read and backend crash through unrestricted provider method calls

• GitroomHQ postiz-app
• Path traversal
• Code injection

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

• Path traversal
• CWE-363

>=4.1.0, <4.2.1 · fixed in 4.2.1

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

• Path traversal
• CWE-363

>=3.20.4, <4.2.1 · fixed in 4.2.1

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

• Path traversal

<3.34.0 · fixed in 3.34.0

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

• Path traversal

>=2.68.0, <3.34.0 · fixed in 3.34.0

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

• Path traversal

>=38.2.2, <84.1.0 · fixed in 84.1.0

Mistune: Path Traversal and XSS in Include directive

• Path traversal

<3.3.0 · fixed in 3.3.0

UbiquitousLearning mllm Convertor __init__.py load_model path traversal

• UbiquitousLearning mllm
• Path traversal

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server

• AWS multi-model-server
• Path traversal

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

• Path traversal
• Broken access control

<1.3.1 · fixed in 1.3.1

Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer

• intranda goobi-viewer-core
• Path traversal

baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure

• baserproject basercms
• Path traversal
• Information disclosure

baserCMS: Encoded path traversal bypass in the theme file API

• baserproject basercms
• Path traversal
• CWE-180

XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal

• flatpak xdg-desktop-portal
• Path traversal

PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write

• Aiven-Open pghoard
• Path traversal

Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter

• codepeople Music Store – WordPress eCommerce
• Path traversal

Kiloview E3 NDI Encoder Path Traversal

• Kiloview E3 Firmware
• Path traversal

VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability

• Microsoft VM Inspector for Azure Virtual Machines
• Path traversal

Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

• Path traversal

* · no fixed version yet

tar filter allows writing outside destination via empty-named symlink

• Python Software Foundation CPython
• Path traversal

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull

• lxc incus
• Path traversal

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream

• lxc incus
• Path traversal