Path Traversal

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix,

The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combine_current_css() function trusting <link rel="stylesheet"

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers wi

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admi

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a path traversal vulnerability in Discourse backup handling could

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or syst

Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path traversal vulnerability. Version 26.5.0 fixes the issue.

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

Routinator has cache path traversal when processing the module component of rsync URIs

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path whe

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into fil

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls

Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

SysAid Server Path Traversal Vulnerability

Mitel MiCollab Path Traversal Vulnerability

Apache HTTP Server Path Traversal Vulnerability

Nostromo nhttpd Directory Traversal Vulnerability

QNAP Photo Station Path Traversal Vulnerability

Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability

SonicWall SMA100 Directory Traversal Vulnerability

TVT NVMS-1000 Directory Traversal Vulnerability

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability

SolarWinds Serv-U Path Traversal Vulnerability

Gogs Path Traversal Vulnerability

SimpleHelp Path Traversal Vulnerability

Ignite Realtime Openfire Path Traversal Vulnerability

Commvault Command Center Path Traversal Vulnerability

Mitel MiCollab Path Traversal Vulnerability

ConnectWise ScreenConnect Path Traversal Vulnerability

Zyxel Multiple Firewalls Path Traversal Vulnerability

Draytek VigorConnect Path Traversal Vulnerability

RARLAB WinRAR Path Traversal Vulnerability

SimpleHelp Path Traversal Vulnerability

RARLAB UnRAR Directory Traversal Vulnerability

Microsoft Windows TS WebProxy Directory Traversal Vulnerability

Kentico Xperience Path Traversal Vulnerability

PEAR Archive_Tar Improper Link Resolution Vulnerability

Kingsoft WPS Office Path Traversal Vulnerability

Oracle Business Intelligence Enterprise Edition Path Transversal

TIBCO JasperReports Server Information Disclosure Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Juniper Junos OS Path Traversal Vulnerability

Apache HTTP Server Path Traversal Vulnerability

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

Fortinet FortiOS Path Traversal Vulnerability

D-Link DIR-859 Router Path Traversal Vulnerability

Microsoft MSHTML Remote Code Execution Vulnerability