CWE-22

High likelihood

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Parent: CWE-706 - Use of Incorrectly-Resolved Name or Reference

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

9,143 vulnerabilities with CWE-22
CVE-2024-51990 CRITICAL
jj-lib < 0.23.0 - Path Traversal and Arbitrary File Write
CVE-2024-51751 MEDIUM
Gradio 5.0.0-5.4.9 - Path Traversal via File or UploadButton Component
CVSS 6.5
CVE-2024-20532 MEDIUM
Cisco Identity Services Engine - Authenticated Path Traversal and Arbitrary File Deletion via API
CVSS 5.5
CVE-2024-20529 MEDIUM
Cisco Identity Services Engine - Authenticated Path Traversal and Arbitrary File Read/Delete via API
CVSS 5.5
CVE-2024-20528 LOW
Cisco Identity Services Engine - Authenticated Path Traversal and Arbitrary File Write via API
CVSS 3.8
CVE-2024-20527 MEDIUM
Cisco Identity Services Engine - Authenticated Arbitrary File Read and Delete via API Parameter
CVSS 5.5
CVE-2024-47464 MEDIUM
Instant AOS-8/AOS-10 - Path Traversal
CVSS 6.8
CVE-2024-51756 LOW
cap-std < 3.4.1 - Path Traversal via Superscript Device Filename Bypass
CVE-2024-47253 HIGH
2N Access Commander <3.1.1.2 - Path Traversal
CVSS 7.2
CVE-2024-51127 HIGH
HornetQ < 2.4.9 - Path Traversal via createTempFile Method
CVSS 7.1
CVE-2024-51582 HIGH
ThimPress WP Hotel Booking <2.1.4 - Path Traversal
CVSS 7.5
CVE-2024-10389 HIGH
Safearchive < 0.0.0-20241025131057-f7ce9d7b6f9c - Path Traversal and Arbitrary File Write via Symbolic Link Extraction
CVSS 7.5
CVE-2024-51483 MEDIUM
changedetection.io < 0.47.5 - Path Traversal via WebDriver File URL
CVE-2024-49770 HIGH
oak < 17.1.3 - Path Traversal via URL-Encoded Forward Slash Bypass
CVE-2024-37423 HIGH
Newspack Blocks <3.0.8 - Path Traversal
CVSS 8.5
CVE-2024-37108 HIGH
WishList Member X <3.26.6 - Path Traversal
CVSS 7.7
CVE-2024-39722 HIGH
Ollama < 0.1.46 - Path Traversal via API Push Route
CVSS 7.5
CVE-2024-39332 CRITICAL
Webswing 23.2.2 - Path Traversal and Remote Code Execution via Client-Side JavaScript Modification
CVSS 9.8
CVE-2024-10005 HIGH
HashiCorp Consul L7 Traffic Intentions - URL Path Access Rule Bypass
CVSS 8.1
CVE-2024-48735 HIGH
SAS Studio 9.4 - Path Traversal via Workspace File Download
CVSS 7.7
CVE-2024-50509 HIGH
Chetan Khandla Woocommerce Product Design <1.0.0 - Path Traversal
CVSS 8.6
CVE-2024-50508 HIGH
Chetan Khandla Woocommerce Product Design <1.0.0 - Path Traversal
CVSS 7.5
CVE-2024-7962 HIGH
gaizhenbiao/chuanhuchatgpt 20240628 - Arbitrary File Read via Insufficient Prompt Template Validation
CVSS 7.5
CVE-2024-7774 CRITICAL
langchain.js < 0.2.19 - Path Traversal via getFullPath Method
CVSS 9.1
CVE-2024-5982 CRITICAL
gaizhenbiao/chuanhuchatgpt < 20240918 - Path Traversal and Arbitrary File Write via Unsanitized Input Handling
CVSS 9.8
Details
Vulnerabilities 9,143
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits