CWE-22
High likelihoodImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
8,747 vulnerabilities with CWE-22
CVE-2026-7599
MEDIUM
Dayoooun hwpx-mcp MCP index.ts export_to_html path traversal
CVSS 6.3
CVE-2026-7594
HIGH
Flux159 mcp-game-asset-gen MCP index.ts image_to_3d_async path traversal
CVSS 7.3
CVE-2026-7589
MEDIUM
ghantakiran splunk-mcp-integration CSV Export csv_export.py create_csv_export path traversal
CVSS 5.3
CVE-2026-7588
MEDIUM
ggerve coding-standards-mcp server.py get_best_practices path traversal
CVSS 5.3
CVE-2026-7519
HIGH
Fujian Apex LiveBOS Endpoint UploadImage.do path traversal
CVSS 7.3
CVE-2026-5656
HIGH
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark
CVSS 7.0
CVE-2026-3345
MEDIUM
Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint
CVSS 6.5
CVE-2026-4502
MEDIUM
Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API
CVSS 6.5
CVE-2026-7445
MEDIUM
ZachHandley ZMCPTools MCP Log Resource ResourceManager.ts path traversal
CVSS 6.3
CVE-2026-7404
HIGH
getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal
CVSS 7.3
CVE-2026-7403
MEDIUM
geldata gel-mcp server.py fetch_rule path traversal
CVSS 5.3
CVE-2026-7400
HIGH
geekgod382 filesystem-mcp-server read_file_tool/write_file_tool server.py is_path_allowed path traversal
CVSS 7.3
CVE-2026-7398
HIGH
florensiawidjaja BioinfoMCP Upload Endpoint app.py upload path traversal
CVSS 7.3
CVE-2026-30893
CRITICAL
Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
CVSS 9.0
CVE-2026-7396
MEDIUM
NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal
CVSS 5.3
CVE-2026-7386
HIGH
fatbobman mail-mcp-bridge mail_mcp_server.py path traversal
CVSS 7.3
CVE-2026-5166
CRITICAL
Path Traversal in TUBITAK BILGEM's Pardus Software Center
CVSS 9.6
CVE-2026-38993
MEDIUM
Cockpit <=2.13.5 - Path Traversal
CVSS 6.5
CVE-2026-7384
HIGH
ezequiroga mcp-bases research_server.py search_papers path traversal
CVSS 7.3
CVE-2026-42520
HIGH
Jenkins Project Jenkins Credentials Binding Plugin < 719.v80e905ef14eb_ - Remote Code Execution
CVSS 7.5
CVE-2026-42249
HIGH
Remote Code Execution in Ollama via Update Mechanism
CVE-2026-7319
HIGH
elinsky execution-system-mcp add_action Tool server.py _get_context_file_path path traversal
CVSS 7.3
CVE-2026-7318
MEDIUM
elie mcp-project research_server.py search_papers path traversal
CVSS 5.9
CVE-2026-7315
HIGH
eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal
CVSS 7.3
CVE-2026-7314
HIGH
eiceblue spire-doc-mcp-server base.py get_doc_path path traversal
CVSS 7.3
Details
Vulnerabilities
8,747
Exploit Likelihood
High