The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
172 vulnerabilities with CWE-35
CVE-2025-20313
MEDIUM
Cisco IOS XE Software 17.3.1-17.3.6 - Path Traversal and Improper Image Integrity Validation
CVSS 6.7
CVE-2025-43886
MEDIUM
Dell PowerProtect Data Manager 19.19-19.20 - Path Traversal via '.../...//'
CVSS 4.4
CVE-2025-48317
HIGH
Stefan Keller WooCommerce Payment Gateway <0.4.9 - Path Traversal
CVSS 7.5
CVE-2025-4956
MEDIUM
AA-Team Pro Bulk Watermark Plugin <2.0 - Path Traversal
CVSS 4.3
CVE-2025-48081
MEDIUM
Printeers Print & Ship <1.17.0 - Path Traversal
CVSS 5.3
CVE-2025-53561
MEDIUM
miniOrange Prevent files / folders access <= 2.6.0 - Path Traversal via '.../...//'
CVSS 6.5
CVE-2025-52712
MEDIUM
BoldGrid Post and Page Builder <1.27.8 - Path Traversal
CVSS 4.2
CVE-2025-8088
HIGH
KEV
WinRAR < 7.13 - Path Traversal and Arbitrary Code Execution via Malicious Archive
CVSS 8.8
CVE-2025-53417
CRITICAL
DIAView < v4.2.0 - Path Traversal and Information Disclosure via '.../...//'
CVE-2025-20320
MEDIUM
Splunk <9.4.3, 9.3.5, 9.2.7, 9.1.10 - DoS
CVSS 6.3
CVE-2025-52805
HIGH
VaultDweller Leyka <3.31.9 - Path Traversal
CVSS 7.5
CVE-2025-52811
HIGH
Creanncy Davenport - Versatile Blog and Magazine WP Theme <1.3 - Pa...
CVSS 8.1
CVE-2025-52810
HIGH
TMRW-studio Katerio - Magazine <1.5.1 - Path Traversal
CVSS 8.1
CVE-2025-49451
HIGH
Aeroscroll Gallery <1.0.12 - Path Traversal
CVSS 7.5
CVE-2025-47176
HIGH
Microsoft 365 Apps and Office LTSC - Path Traversal and Local Code Execution via Outlook Path Handling
CVSS 7.8
CVE-2025-30515
CRITICAL
CyberData 011209 Intercom - File Upload
CVSS 9.8
CVE-2025-49297
HIGH
Grill and Chow <= 1.6 - Path Traversal and PHP Local File Inclusion via '.../...//'
CVSS 8.1
CVE-2025-49296
HIGH
GrandPrix <= 1.6 - Path Traversal and PHP Local File Inclusion via '.../...//'
CVSS 8.1
CVE-2025-49295
HIGH
Mikado-Themes MediClinic <= 2.1 - Path Traversal and Local File Inclusion via '.../...//'
CVSS 8.1
CVE-2025-39475
HIGH
Frenify Arlo <6.0.3 - Path Traversal
CVSS 8.1
CVE-2025-27445
MEDIUM
RSFirewall 2.9.7-3.1.5 - Path Traversal
CVSS 5.4
CVE-2025-5598
CRITICAL
WF Steuerungstechnik GmbH airleader MASTER <3.0046 - Path Traversal
CVE-2025-46441
MEDIUM
Section Widget <3.3.1 - Path Traversal
CVSS 5.3
CVE-2025-27010
HIGH
bslthemes Tastyc <2.5.2 - Path Traversal
CVSS 8.1
CVE-2025-39492
HIGH
WHMPress WHMpress 6.2-revision - Path Traversal via Relative Path
CVSS 7.5
Details
Vulnerabilities
172