CWE-22

High likelihood

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Parent: CWE-706 - Use of Incorrectly-Resolved Name or Reference

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

9,142 vulnerabilities with CWE-22
CVE-2024-53844 MEDIUM
EDDI 4.3-5.3.3 - Path Traversal via RestExportService botFilename Parameter
CVSS 6.3
CVE-2024-33605 HIGH
Multiple MFPs - Path Traversal via installed_emanual_list.html
CVSS 7.5
CVE-2024-52787 CRITICAL
libre-chat 0.0.6 - Path Traversal via Crafted Filename in Uploaded File
CVSS 9.1
CVE-2024-11664 HIGH
eNMS < 4.2 - Path Traversal via TGZ File Handler
CVSS 8.8
CVE-2024-10803 HIGH
MP3 Sticky Player <8.0 - Path Traversal
CVSS 7.5
CVE-2024-7565 HIGH
SMARTBEAR SoapUI - Remote Code Execution via unpackageAll Directory Traversal
CVSS 7.8
CVE-2024-5581 HIGH
Allegra < 7.5.2 - Authenticated Remote Code Execution via UnzipFile Path Traversal
CVSS 7.2
CVE-2024-10220 HIGH
Kubernetes <1.28.11, 1.29.0-1.29.6, 1.30.0-1.30.2 - Command Injection
CVSS 8.1
CVE-2024-37046 MEDIUM
QNAP QTS and QuTS hero - Authenticated Path Traversal
CVSS 4.9
CVE-2024-37043 MEDIUM
QNAP QTS and QuTS hero - Authenticated Path Traversal
CVSS 4.9
CVE-2024-52056 MEDIUM
Wowza Streaming Engine <4.9.1 - Path Traversal
CVSS 6.5
CVE-2024-52055 MEDIUM
Wowza Streaming Engine <4.9.1 - Path Traversal
CVSS 4.9
CVE-2024-52054 LOW
Wowza Streaming Engine <4.9.1 - Path Traversal
CVSS 2.7
CVE-2024-52771 CRITICAL
DedeBIZ 6.3.0 - Arbitrary File Deletion via /admin/file_manage_view
CVSS 9.1
CVE-2024-52449 HIGH
Navneil Naicer Bootscraper <2.1.0 - Path Traversal
CVSS 7.5
CVE-2024-52448 HIGH
WebCodingPlace Ultimate Classified Listings <1.4 - Path Traversal
CVSS 7.5
CVE-2024-52444 HIGH
WPOPAL Opal Woo Custom Product Variation <1.1.3 - Path Traversal
CVSS 7.5
CVE-2024-52600 MEDIUM
Statamic CMS < 5.17.0 - Path Traversal via Crafted Filename Upload
CVSS 5.3
CVE-2024-48071 MEDIUM
Weaver e-cology - Path Traversal and Denial of Service
CVSS 6.5
CVE-2024-47820 MEDIUM
Markus < 2.4.8 - Authenticated Path Traversal
CVSS 5.7
CVE-2024-11303 HIGH
Korenix JetPort <1.2 - Path Traversal
CVE-2024-41971 HIGH
Unknown Product <Version> - Privilege Escalation
CVSS 8.1
CVE-2024-11315 CRITICAL
DVC 6.0-6.3 - Unauthenticated Path Traversal and Arbitrary File Write
CVSS 9.8
CVE-2024-11314 CRITICAL
DVC 6.0-<6.4 - Unauthenticated Path Traversal and Arbitrary File Write
CVSS 9.8
CVE-2024-11313 CRITICAL
DVC 6.0-6.3 - Unauthenticated Path Traversal and Arbitrary File Write
CVSS 9.8
Details
Vulnerabilities 9,142
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits