CWE-22
High likelihoodImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
9,125 vulnerabilities with CWE-22
CVE-2026-3339
LOW
Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter
CVSS 2.7
CVE-2026-33238
MEDIUM
AVideo <26.0 listFiles.json.php - Filesystem Enumeration
CVSS 4.3
CVE-2026-3864
MEDIUM
CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server
CVSS 6.5
CVE-2026-33476
HIGH
SiYuan <3.6.2 appearance Filepath - Arbitrary File Read
CVSS 7.5
CVE-2026-33236
HIGH
NLTK <=3.9.3 Downloader XML Index - Arbitrary File Overwrite
CVSS 8.1
CVE-2026-33194
MEDIUM
SiYuan <3.6.2 IsSensitivePath - Arbitrary File Read
CVSS 6.8
CVE-2026-32733
MEDIUM
Halloy DCC File Transfers - Path Traversal
CVSS 6.5
CVE-2026-33171
MEDIUM
Statamic File Dictionary Fieldtype - Path Traversal
CVSS 4.3
CVE-2026-33166
HIGH
Allure Report <2.38.0 Attachment Processing - Arbitrary File Read
CVSS 8.6
CVE-2026-23536
HIGH
Feast Feature Server - Unauthenticated Arbitrary File Read
CVSS 7.5
CVE-2026-32310
MEDIUM
Cryptomator: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths
CVSS 4.1
CVE-2026-30580
MEDIUM
File Thingie 2.5.7 - Path Traversal
CVSS 4.3
CVE-2026-2421
MEDIUM
ilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter
CVSS 6.5
CVE-2026-27625
HIGH
Stirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction
CVSS 8.1
CVE-2026-33054
CRITICAL
Mesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion
CVSS 10.0
CVE-2026-32938
CRITICAL
SiYuan <3.6.1 Desktop Publish Service - Arbitrary File Read
CVSS 9.9
CVE-2026-32808
HIGH
pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification
CVSS 8.1
CVE-2026-32711
HIGH
pydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
CVSS 7.8
CVE-2026-32771
CRITICAL
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization
CVSS 9.8
CVE-2026-32758
MEDIUM
File Browser <2.62.0 Copy/Rename Destination - Access Rule Bypass
CVSS 6.5
CVE-2026-22737
MEDIUM
Spring Framework Improper Path Limitation with Script View Templates
CVSS 5.9
CVE-2026-32750
MEDIUM
SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes
CVSS 6.8
CVE-2026-32036
MEDIUM
OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels
CVSS 6.5
CVE-2026-32033
MEDIUM
OpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation
CVSS 6.5
CVE-2026-32030
HIGH
OpenClaw < 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversal
CVSS 7.5
Details
Vulnerabilities
9,125
Exploit Likelihood
High