CWE-22
High likelihoodImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
9,130 vulnerabilities with CWE-22
CVE-2025-12638
HIGH
Keras < 3.12.0 - Path Traversal and Arbitrary File Write via tarfile.extractall()
CVSS 8.0
CVE-2025-59890
HIGH
Eaton Galileo Software < 11.1.1 - Path Traversal via File Archive Upload
CVSS 7.3
CVE-2025-66262
CRITICAL
DB Electronica Mozart FM Transmitter - Path Traversal via Tar Extraction
CVSS 9.8
CVE-2025-66251
CRITICAL
DB Electronica Mozart FM Transmitter - Path Traversal & File Deletion via 'deletehidden'
CVSS 9.1
CVE-2025-65952
HIGH
Console < 2.8.0 - Path Traversal and Arbitrary File Write via Backslash and Period Bypass
CVE-2025-34350
HIGH
UnForm Server <10.1.15 - Info Disclosure
CVE-2025-59372
MEDIUM
ASUS Router 3.0.0.4_386 3.0.0.4_388 3.0.0.6_102 - Authenticated Path Traversal and Arbitrary File Write
CVE-2025-59366
CRITICAL
ASUS Router - Authentication Bypass via Samba Functionality
CVE-2025-12003
HIGH
ASUS Router 3.0.0.4_386 3.0.0.4_388 3.0.0.6_102 - Unauthenticated Path Traversal via WebDAV
CVE-2025-54347
CRITICAL
Desktop Alert PingAlert Application Server 6.1.0.11-6.1.1.2 - Path Traversal and Arbitrary File Write
CVSS 9.9
CVE-2025-60915
HIGH
Austrian Archaeological Institute Openatlas <8.12.0 - Path Traversal
CVSS 8.1
CVE-2025-12972
MEDIUM
Fluent Bit - Path Traversal and Arbitrary File Write via out_file Plugin Tag Handling
CVSS 5.3
CVE-2025-31248
MEDIUM
macOS < 13.7.3, < 14.7.3, < 15.5 - Unprotected User Data Exposure via Path Handling Issue
CVSS 5.5
CVE-2025-34320
CRITICAL
BASIS BBj < 25.00 - Unauthenticated Path Traversal and Arbitrary File Read via Jetty Web Endpoint
CVE-2025-13435
MEDIUM
Dreampie Resty < 1.3.1 - Path Traversal via HttpClient Module Filename Argument
CVSS 5.6
CVE-2025-11001
HIGH
7-Zip - Remote Code Execution via Symbolic Link Traversal in ZIP File Parsing
CVSS 7.8
CVE-2025-63371
HIGH
OneCommander 3.102.0.0 - Path Traversal
CVSS 7.5
CVE-2025-65025
HIGH
esm.sh < 136 - Path Traversal and Arbitrary File Write via NPM Package Tarball Extraction
CVSS 8.2
CVE-2025-64765
MEDIUM
Astro < 5.15.8 - Path Traversal via Decoded URI Bypass
CVSS 5.3
CVE-2025-64757
LOW
Astro < 5.14.3 - Unauthenticated Arbitrary Local File Read via Image Optimization Endpoint
CVSS 3.5
CVE-2025-63408
HIGH
Local Agent DVR <6.6.1.0 - Path Traversal
CVSS 7.8
CVE-2025-41736
HIGH
metz-connect ewio2-m_firmware < 2.2.0 - Path Traversal and Remote Code Execution via Python Script Upload
CVSS 8.8
CVE-2025-40549
CRITICAL
SolarWinds Serv-U < 15.5.3 - Authenticated Path Traversal
CVSS 9.1
CVE-2025-63918
MEDIUM
PDFPatcher < 1.1.3.4663 - Path Traversal and Arbitrary File Write via Image Export
CVSS 6.2
CVE-2025-13266
MEDIUM
vlife-base < 2.0.1 - Path Traversal via SysFileApi create Function
CVSS 5.3
Details
Vulnerabilities
9,130
Exploit Likelihood
High