CWE-22
High likelihoodImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
9,135 vulnerabilities with CWE-22
CVE-2025-11630
MEDIUM
docsys < 2.02.36 - Path Traversal via File Upload Path Parameter
CVSS 6.3
CVE-2025-61884
HIGH
KEV
Oracle Configurator 12.2.3-12.2.14 - Unauthenticated CRLF Injection via Runtime UI
CVSS 7.5
CVE-2025-11607
MEDIUM
harry0703/moneyprinterturbo < 1.2.6 - Path Traversal via File Argument in upload_music Function
CVSS 6.3
CVE-2025-9950
MEDIUM
BestWebSoft plugin <1.1.6 - Path Traversal
CVSS 4.9
CVE-2025-6439
CRITICAL
WooCommerce Designer Pro <1.9.26 - Path Traversal
CVSS 9.8
CVE-2025-21048
MEDIUM
Samsung Android Knox Enterprise - Local Arbitrary Code Execution via Relative Path Traversal
CVSS 6.7
CVE-2025-35056
MEDIUM
Newforma Project Center < 2024.1 - Authenticated Arbitrary File Read via StreamStampImage
CVSS 5.0
CVE-2025-35055
HIGH
Newforma Project Center < 2023.1 - Unauthenticated Path Traversal and Arbitrary File Write via UploadBlueimp.ashx
CVSS 8.8
CVE-2025-35053
MEDIUM
Newforma Project Center < 2024.3 - Authenticated Path Traversal and Arbitrary File Deletion via MarkupServices.ashx
CVSS 6.4
CVE-2025-34248
HIGH
D-Link Nuclias Connect <1.3.1.4 - Path Traversal
CVE-2025-10284
CRITICAL
BBOT < 2.7.0 - Remote Code Execution via Malicious Archive Extraction
CVSS 9.6
CVE-2025-10283
CRITICAL
BBOT < 2.7.0 - Remote Code Execution via Git Repository Command Injection
CVSS 9.6
CVE-2025-39664
MEDIUM
Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1.0 - Authenticated Path Traversal in Report Scheduler
CVSS 6.5
CVE-2025-7526
CRITICAL
WP Travel Engine - Tour Booking Plugin - Path Traversal
CVSS 9.8
CVE-2025-61913
CRITICAL
Flowise < 3.0.8 - Authenticated Path Traversal and Arbitrary File Write via WriteFileTool and ReadFileTool
CVSS 9.9
CVE-2025-61784
HIGH
llama-factory < 0.9.4 - SSRF and LFI via _process_request
CVSS 7.6
CVE-2025-43934
MEDIUM
Dell PowerProtect Data Domain Path Traversal and Unauthorized Access
CVSS 6.0
CVE-2025-43889
MEDIUM
Dell PowerProtect Data Domain 7.7.1.0-8.4, 7.13.1.0-7.13.1.30, 7.10.1.0-7.10.1.60 - Unauthenticated Path Traversal in UI
CVSS 5.3
CVE-2025-40889
HIGH
Nozomi Networks CMC and Guardian < 25.2.0 - Authenticated Path Traversal via Time Machine Input Parameters
CVSS 8.1
CVE-2025-3718
HIGH
Nozomi Networks CMC and Guardian < 25.2.0 - Authenticated Path Traversal and Cross-Site Scripting via Malicious URL
CVSS 7.9
CVE-2025-60969
MEDIUM
EndRun Technologies Sonoma D12 - Info Disclosure
CVSS 5.7
CVE-2025-11337
MEDIUM
Four-Faith Water Conservancy Informatization Platform <2.2 - Path T...
CVSS 5.3
CVE-2025-11336
MEDIUM
Four-Faith Water Conservancy Informatization Platform <2.2 - Path T...
CVSS 5.3
CVE-2025-58591
MEDIUM
SICK Analytics Products - Directory Traversal Information Disclosure
CVSS 6.5
CVE-2025-58590
MEDIUM
Sick Analytics Products <= 4.6.1 - Information Disclosure via Path Traversal
CVSS 6.5
Details
Vulnerabilities
9,135
Exploit Likelihood
High