CWE-22
High likelihoodImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
9,125 vulnerabilities with CWE-22
CVE-2026-3013
HIGH
Coppermine Photo Gallery 1.6.09-1.6.27 - Path Traversal
CVE-2026-32061
MEDIUM
OpenClaw <2026.2.17 - Path Traversal
CVSS 4.4
CVE-2026-32060
HIGH
OpenClaw <2026.2.14 - Path Traversal
CVSS 8.8
CVE-2026-21360
MEDIUM
Adobe Commerce <=2.4.9-alpha3 - Path Traversal
CVSS 6.8
CVE-2026-31817
HIGH
OliveTin <3000.11.2 - Path Traversal
CVSS 8.5
CVE-2026-28807
HIGH
wisp 2.1.1-2.2.1 - Unauthenticated Arbitrary File Read via Percent-Encoded Path Traversal
CVSS 7.5
CVE-2026-30952
HIGH
liquidjs < 10.25.0 - Path Traversal via Layout, Render, and Include Tags
CVSS 7.5
CVE-2026-27825
CRITICAL
MCP Atlassian <0.17.0 - Path Traversal
CVSS 9.0
CVE-2026-30973
MEDIUM
@appium/support < 7.0.6 - Path Traversal via Malicious ZIP Entry Extraction
CVSS 6.5
CVE-2026-30958
HIGH
OneUptime <10.0.21 - Path Traversal
CVSS 7.2
CVE-2026-30942
MEDIUM
Flare < 1.7.3 - Authenticated Path Traversal via Avatar Filename Parameter
CVSS 6.5
CVE-2026-2741
MEDIUM
Vaadin 14.2.0-14.14.0/23.0.0-23.6.6/24.0.0-24.9.8/25.0.0-25.0.2 - P...
CVSS 6.8
CVE-2026-23907
MEDIUM
Apache PDFBox 2.0.24-2.0.35, 3.0.0-3.0.6 - Path Traversal
CVSS 5.3
CVE-2026-3585
HIGH
The Events Calendar <6.15.17 - Path Traversal
CVSS 7.5
CVE-2026-30869
CRITICAL
SiYuan < 3.5.10 - Path Traversal and Arbitrary File Read via Double-Encoded Sequences
CVSS 9.3
CVE-2026-31802
MEDIUM
tar < 7.5.11 - Path Traversal via Drive-Relative Symlink Target
CVSS 5.5
CVE-2026-1776
MEDIUM
Camaleon CMS 2.4.5.0-2.9.0 - Path Traversal
CVSS 6.5
CVE-2026-30240
CRITICAL
Budibase < 3.31.5 - Authenticated Path Traversal via PWA ZIP Processing Endpoint
CVSS 9.6
CVE-2026-3089
MEDIUM
Actual Sync Server <26.3.0 - Path Traversal
CVSS 6.5
CVE-2026-3795
MEDIUM
doramart DoraCMS 3.0.x - Path Traversal via createFileBypath Function
CVSS 6.3
CVE-2026-3719
MEDIUM
Tsinghua Unigroup Electronic Archives 3.2.210802 - Path Traversal
CVSS 5.3
CVE-2026-3695
MEDIUM
Modern Image Gallery App 1.0 - Path Traversal
CVSS 6.5
CVE-2026-30848
LOW
Parse Server <8.6.8/9.5.0-alpha.8 - Path Traversal
CVSS 3.7
CVE-2026-29786
MEDIUM
tar < 7.5.10 - Path Traversal via Drive-Relative Hardlink
CVSS 6.3
CVE-2026-29780
MEDIUM
eml-parser < 2.0.1 - Path Traversal and Arbitrary File Write via Unsanitized Attachment Filename
CVSS 5.5
Details
Vulnerabilities
9,125
Exploit Likelihood
High