Path traversal.

SABnzbd: Orphan-job path traversal permits arbitrary file deletion

• sabnzbd
• Path traversal

Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read

• Stirling-Tools Stirling-PDF
• Path traversal
• Server-side request forgery (SSRF)

Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

• Stirling-Tools Stirling-PDF
• Path traversal
• Server-side request forgery (SSRF)

Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink

• pi-hole
• Path traversal
• CWE-61

Pi-hole: file:// adlist read check and curl can resolve different files

• pi-hole
• Path traversal

pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check

• pgadmin.org pgAdmin 4
• Path traversal
• Race condition

pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

• pgadmin.org pgAdmin 4
• Path traversal

pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

• pgadmin.org pgAdmin 4
• Path traversal
• Race condition

Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service

• immich
• Path traversal

WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability

• Brainstorm Force SureDash
• Path traversal

WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability

• Saad Iqbal WP EasyPay
• Path traversal

LM Studio before 0.4.22+1 Path Traversal via Model Downloader

• Element Labs LM Studio
• Path traversal

gettext: Directory traversal via the LANGUAGE environment variable

• The GNU C Library glibc
• Path traversal

JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter

• rabilal JS Help Desk – AI-Powered Support & Ticketing System
• Path traversal

croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive

• schollz croc
• Path traversal

zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory

• zuke
• Path traversal

Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp

• bastille
• Path traversal

SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)

• socfortress CoPilot
• Path traversal
• Unrestricted file upload

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup

• Path traversal
• CWE-379

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route

• Path traversal

n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node

• n8n
• Path traversal

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal

• moodle
• Path traversal

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

• forgejo
• Path traversal

ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass

• ProFTPD
• Path traversal

Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Path traversal

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

• Drupal Single Content Sync
• Path traversal

Symlink following in Apple Xcode

• Apple Xcode
• Path traversal

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a cr…

• Path traversal

Path traversal in Veeam Management Pack for Microsoft System Center

• Veeam Management Pack for Microsoft System Center
• Path traversal

Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

• lightdash
• Path traversal

External control of a file path in Ubiquiti Inc WiFiman Desktop

• Ubiquiti Inc WiFiman Desktop
• Path traversal

Nomad allocation data migration may allow host directory permission modification via symlink following

• HashiCorp Nomad
• HashiCorp Nomad Enterprise
• Path traversal

Nomad dispatch payload writes can escape the allocation directory through symlinks

• HashiCorp Nomad
• HashiCorp Nomad Enterprise
• Path traversal

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

• Path traversal
• CWE-61

>=7.2.0, <9.0.0 · fixed in 9.0.0

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

• Path traversal

<26.6.4 · fixed in 26.6.4

Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source

• kubeflow pipelines
• Path traversal

Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

• frappe
• Path traversal

Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server

• Progress Software WS_FTP Server
• Path traversal

Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

• Progress Software WS_FTP Server
• Path traversal
• Unrestricted file upload

Host Administrator Path Containment Bypass in Progress WS_FTP Server

• Progress Software WS_FTP Server
• Path traversal
• Unrestricted file upload

Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server

• Progress Software WS_FTP Server
• Path traversal

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Path traversal

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Path traversal

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Path traversal

Adobe Digital Editions | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

• Adobe Digital Editions
• Path traversal

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Path traversal

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Path traversal

Path Traversal in Szafir

• Krajowa Izba Rozliczeniowa Szafir
• Path traversal

MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

• Stylemix MasterStudy LMS WordPress Plugin
• Path traversal

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification

• Elastic Cloud Enterprise
• Path traversal

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss

• Elastic Cloud Enterprise
• Path traversal

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass

• Elastic Cloud Enterprise
• Path traversal

Path Traversal in BMC ITSM

• BMC IT Service Management Suite
• Path traversal

Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal

• Automated Import Products to Cart
• Path traversal

OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46).

• Path traversal

DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129).

• Path traversal

modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file.

• Path traversal

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.

• Path traversal

Backstage catalog rules can be bypassed for URL locations using encoded path segments

• Path traversal

<3.9.2 || >=4.0.0, <4.0.2 · fixed in 3.9.2, 4.0.2

Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

• domoticz
• Path traversal
• Broken access control