CWE-22
High likelihoodImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
8,747 vulnerabilities with CWE-22
CVE-2026-39308
HIGH
PraisonAI recipe registry publish path traversal allows out-of-root file write
CVSS 7.1
CVE-2026-39307
HIGH
PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction
CVSS 8.1
CVE-2026-39306
HIGH
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
CVSS 7.3
CVE-2026-39305
CRITICAL
Arbitrary File Write / Path Traversal in Action Orchestrator
CVSS 9.0
CVE-2026-35615
HIGH
PraisonAI has a Path Traversal in FileTools
CVSS 7.5
CVE-2026-35613
MEDIUM
Path traversal in coursevault-preview due to improper base-directory boundary validation
CVSS 5.1
CVE-2026-35605
HIGH
File Browser has an access rule bypass via HasPrefix without trailing separator in path matching
CVSS 7.5
CVE-2026-35592
MEDIUM
pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
CVSS 5.3
CVE-2026-35583
MEDIUM
Emissary has a Path Traversal via Blacklist Bypass in Configuration API
CVSS 5.3
CVE-2026-35492
MEDIUM
Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write
CVSS 6.5
CVE-2026-35487
MEDIUM
text-generation-webui has a Path Traversal in load_prompt() — .txt file read without authentication
CVSS 5.3
CVE-2026-35485
HIGH
text-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authentication
CVSS 7.5
CVE-2026-35484
MEDIUM
text-generation-webui has a Path Traversal in load_preset() — .yaml file read without authentication
CVSS 5.3
CVE-2026-35483
MEDIUM
text-generation-webui has a Path Traversal in load_template() — .jinja/.yaml/.yml file read without authentication
CVSS 5.3
CVE-2026-33227
MEDIUM
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ Web: Improper Limitation of a Pathname to a Restricted Classpath Directory
CVSS 4.3
CVE-2026-35471
CRITICAL
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs
CVSS 9.8
CVE-2026-35454
MEDIUM
Code Extension Marketplace has a Zip Slip Path Traversal
CVSS 6.5
CVE-2026-35393
CRITICAL
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
CVSS 9.8
CVE-2026-35392
CRITICAL
goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
CVSS 9.8
CVE-2026-35177
MEDIUM
Path traversal issue with zip.vim in Vim
CVSS 4.1
CVE-2026-35174
CRITICAL
Chyrp Lite has a Path Traversal to Remote Code Execution
CVSS 9.1
CVE-2026-35167
HIGH
Kedro has a path traversal in versioned dataset loading via unsanitized version string
CVSS 7.1
CVE-2026-35050
CRITICAL
text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml".
CVSS 9.1
CVE-2026-34783
HIGH
Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites
CVSS 8.1
CVE-2026-5638
MEDIUM
HerikLyma CPPWebFramework path traversal
CVSS 5.3
Details
Vulnerabilities
8,747
Exploit Likelihood
High