Path traversal.

Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

• Mattermost
• Path traversal

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

• Path traversal

<5.33.14 · fixed in 5.33.14

gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

• gopass
• Path traversal

CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path

• giuspen cherrytree
• Path traversal

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

• Path traversal

>=3.32.6, <4.2.1 · fixed in 4.2.1

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

• Path traversal
• Information disclosure

>=3.20.4, <4.0.9 · fixed in 4.0.9

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

• Path traversal

>=1.2.3, <1.2.14 · fixed in 1.2.14

Echo static file middleware route protection bypass via encoded dot-dot traversal

• Path traversal

<4.16.0 · fixed in 4.16.0

mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

• Path traversal

<1.4.0 · fixed in 1.4.0

FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

• fearlessgeekmedia FearlessCMS
• Path traversal
• Cross-site scripting (XSS)

SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias

• siyuan
• Path traversal

Path traversal in Sophos SG UTM

• Sophos SG UTM
• Path traversal

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes

• Path traversal

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability

• Ultralytics
• Path traversal

Path traversal in Jenkins

• Jenkins
• Path traversal

Symlink following in Jenkins

• Jenkins
• Path traversal

Symlink following in Jenkins

• Jenkins
• Path traversal

Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Path traversal

Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Path traversal

Path Traversal in Wing WFTP Server leading to Remote Code Execution

• Wing Soft Technology Wing FTP Server
• Path traversal

Path Traversal in Telerik Document Processing Libraries AI Agent Tools

• Progress Software Telerik Document Processing Libraries
• Path traversal

Axel Download Accelerator Path Traversal via URL Filename Decoding

• Axel
• Path traversal

Norton, Avast, and AVG local privilege escalation via link following in Data Shredder

• Gen Digital Norton Antivirus
• Gen Digital Avast Antivirus
• Path traversal

Path traversal in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Path traversal

Path traversal in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Path traversal

Authenticated Arbitrary Local File Read via Path Traversal in HAVELSAN's Liman MYS

• HAVELSAN Inc. Liman MYS
• Path traversal

Path traversal in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Path traversal

Path traversal in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Path traversal

Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment

• Tainacan
• Path traversal

Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload

• King-Theme Product Designer for WooCommerce WordPress | Lumise
• Path traversal

AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter

• tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
• Path traversal

GRR vulnerable to Arbitrary File Read and Deletion

• JeromeDevome GRR
• Path traversal

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

• Path traversal

>=3.10.0, <3.17.0 · fixed in 3.17.0

Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE

• asterisk
• certified-asterisk
• Path traversal
• Broken access control

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

• Path traversal

<0.0.0-20260814233832-4126edeb07a0 · fixed in 0.0.0-20260814233832-4126edeb07a0

Sunhillo SureLine Path Traversal via radarUpdater.cgi

• Sunhillo Corporation SureLine
• Path traversal

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

• Tanium Endpoint Configuration Toolset Solution
• Tanium end-user-cx
• Path traversal

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

• Tanium Endpoint Configuration Toolset Solution
• Tanium threat-response-cx
• Path traversal

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

• Tanium Endpoint Configuration Toolset Solution
• Tanium end-user-cx
• Path traversal
• CWE-282

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

• Tanium Endpoint Configuration Toolset Solution
• Tanium end-user-cx
• Path traversal

Path traversal in Veeam Backup and Replication

• Veeam Backup and Replication
• Path traversal

Path traversal in Veeam Backup and Replication

• Veeam Backup and Replication
• Path traversal

Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root

• WatchGuard Fireware OS
• Path traversal
• Broken access control

Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root

• WatchGuard Fireware OS
• Path traversal
• CWE-377

Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal

• Dexmal Dexbotic
• Path traversal

Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

• Path traversal

<1.48.0 · fixed in 1.48.0

LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

• Path traversal
• CWE-20

<1.95.0 · fixed in 1.95.0

crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal

• crownpku Rasa_NLU_Chi
• Path traversal

GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)

• Path traversal
• Command injection

<3.2.0 · fixed in 3.2.0

GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree

• Path traversal

<3.2.0 · fixed in 3.2.0

NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment

• Path traversal

<3.10.4 · fixed in 3.10.4

Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs

• Path traversal

<2.0.82 · fixed in 2.0.82

Path traversal in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Path traversal

Path traversal in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Path traversal

Path traversal in Octopus Deploy Octopus Server

• Octopus Deploy Octopus Server
• Path traversal

EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

• icret EasyImages2.0
• Path traversal

YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter

• yeswiki
• Path traversal

WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

• WWBN AVideo
• Path traversal

SourceCodester Online Food Ordering System delete.php unlink path traversal

• SourceCodester Online Food Ordering System
• Path traversal

Subpath symlinking on Windows nodes permits NTLM coercion

• Kubernetes
• Path traversal