CWE-22
High likelihoodImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
9,125 vulnerabilities with CWE-22
CVE-2026-30290
HIGH
InTouch Contacts & Caller ID APP 6.38.1 - File Overwrite
CVSS 8.4
CVE-2026-30285
CRITICAL
Zora: Post, Trade, Earn Crypto 2.60.0 - Arbitrary File Overwrite
CVSS 9.8
CVE-2026-30286
CRITICAL
Zefiro Cloud 32.0.2026011614 - File Overwrite
CVSS 9.8
CVE-2026-30283
CRITICAL
PEAKSEL D.O.O. NIS Animal Sounds and Ringtones 1.3.0 - Arbitrary File Overwrite
CVSS 9.8
CVE-2026-30282
CRITICAL
Cast to TV Screen Mirroring 2.2.77 - File Overwrite
CVSS 9.0
CVE-2026-30279
HIGH
My Location Travel Timeline 11.80 - File Overwrite
CVSS 8.4
CVE-2026-30278
CRITICAL
FLY is FUN Aviation Navigation 35.33 - Arbitrary File Overwrite
CVSS 9.8
CVE-2026-30277
HIGH
PDF Reader App TA/UTAX Mobile Print 3.7.2.251001 - Arbitrary File Overwrite
CVSS 8.4
CVE-2026-5203
MEDIUM
CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal
CVSS 4.7
CVE-2026-33581
MEDIUM
OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters
CVSS 6.5
CVE-2026-29870
HIGH
agentic-context-engine <=0.7.1 - Path Traversal
CVSS 7.6
CVE-2026-34070
HIGH
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
CVSS 7.5
CVE-2026-32727
HIGH
SciTokens: Authorization Bypass via Path Traversal in Scope Validation
CVSS 8.1
CVE-2026-30940
HIGH
baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE
CVSS 7.2
CVE-2026-27018
HIGH
Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme
CVSS 7.5
CVE-2026-33027
MEDIUM
Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory
CVSS 6.5
CVE-2026-5014
MEDIUM
elecV2 elecV2P Wildcard log path.join path traversal
CVSS 5.3
CVE-2026-5013
MEDIUM
elecV2 elecV2P :key path.join path traversal
CVSS 5.3
CVE-2026-4999
MEDIUM
z-9527 admin isImg Check upload.js uploadFile path traversal
CVSS 6.3
CVE-2026-4997
MEDIUM
Sinaptik AI PandasAI sql_sanitizer.py is_sql_query_safe path traversal
CVSS 5.3
CVE-2026-33989
HIGH
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
CVSS 8.1
CVE-2026-5027
HIGH
Langflow - Path Traversal Arbitrary File Write via upload_user_file
CVSS 8.8
CVE-2026-33748
HIGH
BuildKit Git URL subdir component can cause access to restricted files
CVSS 7.5
CVE-2026-29871
HIGH
awesome-llm-apps e46690f - Path Traversal
CVSS 7.5
CVE-2026-4619
CRITICAL
Aterm WX3600HP < 1.5.3 - Path Traversal and Arbitrary File Write
CVSS 9.8
Details
Vulnerabilities
9,125
Exploit Likelihood
High