CWE-22

High likelihood

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Parent: CWE-706 - Use of Incorrectly-Resolved Name or Reference

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

9,142 vulnerabilities with CWE-22
CVE-2024-53582 HIGH
OpenPanel 0.3.4 - Path Traversal via File Manager Copy and View Functions
CVSS 7.5
CVE-2024-53537 CRITICAL
openpanel 0.2.1-0.3.4 - Path Traversal in File Manager File Actions
CVSS 9.1
CVE-2024-55415 MEDIUM
DevDojo Voyager < 1.8.0 - Path Traversal via /admin/compass
CVSS 5.7
CVE-2024-13720 HIGH
WP Image Uploader <= 1.0.1 - Unauthenticated Arbitrary File Deletion via gky_image_uploader_main_function
CVSS 8.8
CVE-2024-13671 HIGH
Music Sheet Viewer < 4.1 - Unauthenticated Arbitrary File Read via read_score_file()
CVSS 7.5
CVE-2024-54462 HIGH
image_picker_android >=0.8.5+6 <0.8.12+18 - Path Traversal via Malicious Document Provider
CVSS 7.1
CVE-2024-54461 HIGH
file_selector_android 0.5.1-0.5.1+11 - Path Traversal via Malicious Document Provider
CVSS 7.1
CVE-2024-57549 HIGH
CMSimple 5.16 - Path Traversal via File Parameter
CVSS 7.5
CVE-2024-54520 MEDIUM
macOS < 13.7.2, < 14.7.2, < 15.2 - Arbitrary File Write via Path Handling Issue
CVSS 5.5
CVE-2024-45598 MEDIUM
Cacti < 1.2.29 - Authenticated Arbitrary File Read via Poller Standard Error Log Path
CVSS 6.0
CVE-2024-13550 MEDIUM
ABC Notation < 6.1.3 - Authenticated Path Traversal via abcjs Shortcode File Attribute
CVSS 6.5
CVE-2024-12885 MEDIUM
Connections Business Directory <10.4.66 - Path Traversal
CVSS 6.5
CVE-2024-13409 HIGH
Post Grid Slider Carousel Ultimate <1.6.10 - Local File Inclusion
CVSS 7.5
CVE-2024-13545 CRITICAL
Bootstrap Ultimate < 1.4.9 - Unauthenticated Local File Inclusion via Path Parameter
CVSS 9.8
CVE-2024-55926 HIGH
Xerox Workplace Suite - Info Disclosure
CVSS 7.6
CVE-2024-42187 MEDIUM
BigFix Patch Download Plug-ins - Path Traversal
CVSS 5.3
CVE-2024-45652 MEDIUM
IBM Maximo Asset Management 7.6.1.3 - Path Traversal via MXAPIASSET API
CVSS 6.5
CVE-2024-10799 MEDIUM
Eventer WordPress Plugin <= 3.9.7 - Authenticated Path Traversal
CVSS 6.5
CVE-2024-52363 MEDIUM
IBM InfoSphere Information Server 11.7 - Path Traversal
CVSS 6.5
CVE-2024-57784 MEDIUM
Zenitel AlphaWeb XE v11.2.3.10 - Path Traversal
CVSS 5.5
CVE-2024-48885 MEDIUM
Fortinet FortiRecorder 7.0.0-7.0.4, 7.2.0-7.2.1; FortiVoice 6.0-6.4.9, 7.0.0-7.0.4; FortiWeb 6.4-7.6.0 - Path Traversal
CVSS 5.3
CVE-2024-57728 HIGH KEV
SimpleHelp < 5.5.8 - Authenticated Path Traversal and Arbitrary File Write via Zip Slip
CVSS 7.2
CVE-2024-57727 HIGH KEV
SimpleHelp Path Traversal Vulnerability CVE-2024-57727
CVSS 7.5
CVE-2024-54535 MEDIUM
iPadOS < 18.1 - Unprotected User Data Exposure via Path Handling Issue
CVSS 4.3
CVE-2024-13158 HIGH
Ivanti Endpoint Manager < 2024 - Authenticated Remote Code Execution via Unbounded Resource Search Path
CVSS 7.2
Details
Vulnerabilities 9,142
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits