CWE-22
High likelihoodImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
9,092 vulnerabilities with CWE-22
CVE-2026-46724
MEDIUM
Path Traversal in extension "Faceted Search" (ke_search)
CVE-2026-31379
MEDIUM
Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager
CVSS 6.1
CVE-2026-29220
MEDIUM
Apache OFBiz: Low-Privilege LFI in Content Component
CVSS 6.5
CVE-2026-47091
LOW
Claude HUD 0.0.12 Path Traversal via transcript_path
CVSS 3.3
CVE-2026-45230
CRITICAL
DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file
CVSS 9.1
CVE-2026-29963
HIGH
HSC MailInspector 5.3.3-7 - Path Traversal
CVSS 7.5
CVE-2026-20685
MEDIUM
Apple Private Cloud Compute Server Software < 5E290.3 - Improper Input Validation
CVSS 6.5
CVE-2026-8802
MEDIUM
opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal
CVSS 4.3
CVE-2026-6381
HIGH
WP Maps < 4.9.3 - Subscriber+ Local File Inclusion
CVSS 7.5
CVE-2026-8770
LOW
continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal
CVSS 3.3
CVE-2026-8765
MEDIUM
Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal
CVSS 4.3
CVE-2026-8757
HIGH
adenhq hive Delete Request routes_sessions.py _read_events_tail path traversal
CVSS 7.3
CVE-2026-8756
HIGH
fishaudio Bert-VITS2 Gradio webui_preprocess.py generate_config path traversal
CVSS 7.3
CVE-2026-8755
HIGH
fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal
CVSS 7.3
CVE-2026-8754
MEDIUM
AstrBotDevs AstrBot File Upload chat.py post_file path traversal
CVSS 6.3
CVE-2026-8736
MEDIUM
Oinone Pamirs RestController LocalFileClient.java request.getParameter path traversal
CVSS 4.1
CVE-2026-44566
HIGH
Open WebUI: Arbitrary File Upload and Path Traversal
CVSS 7.3
CVE-2026-44565
HIGH
Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal
CVSS 8.1
CVE-2026-46383
MEDIUM
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
CVSS 5.5
CVE-2026-44641
HIGH
Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install
CVSS 7.1
CVE-2026-7182
CRITICAL
Path Traversal in Diagram
CVE-2026-41552
HIGH
Path Traversal in PDF Export Module
CVSS 7.5
CVE-2026-6403
HIGH
Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter
CVSS 7.5
CVE-2026-44647
HIGH
OneDev: Path Traversal (read capability via Git LFS pointer resolution)
CVE-2026-44522
HIGH
Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution
Details
Vulnerabilities
9,092
Exploit Likelihood
High