CWE-36
Absolute Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
126 vulnerabilities with CWE-36
CVE-2026-53698
MEDIUM
Silverpeas < 6.4.6 - Absolute Path Traversal
CVSS 6.5
CVE-2026-10075
MEDIUM
Interinfo｜DreamMaker - Path Traversal
CVSS 5.3
CVE-2026-10044
HIGH
ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/
CVSS 7.5
CVE-2026-32997
HIGH
Veeam Backup And Replication < 13.0.1 - Absolute Path Traversal
CVE-2026-4782
MEDIUM
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
CVSS 6.5
CVE-2026-32175
MEDIUM
.NET 10.0 < 10.0.8, 9.0 < 9.0.16, 8.0 < 8.0.27 - Path Traversal and Arbitrary File Write
CVSS 4.3
CVE-2026-42315
HIGH
pyLoad: Path Traversal via Package Folder Name in set_package_data
CVSS 8.1
CVE-2026-6418
MEDIUM
PaperCut NG/MF: Path Traversal in Shared Account Synchronization
CVSS 4.9
CVE-2026-44029
MEDIUM
Nix 2.24.7-2.34.6 - Arbitrary File Write via Directory Traversal in nix-prefetch-url and nix store prefetch-file
CVSS 5.3
CVE-2026-7217
MEDIUM
Deepractice PromptX Document File index.ts read_pdf absolute path traversal
CVSS 5.3
CVE-2026-35465
HIGH
SecureDrop Client has path injection in read_gzip_header_filename()
CVSS 7.5
CVE-2026-34515
HIGH
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
CVSS 7.5
CVE-2026-4373
HIGH
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
CVSS 7.5
CVE-2026-0846
HIGH
nltk < 3.9.3 - Arbitrary File Read via filestring() Function
CVSS 7.5
CVE-2026-2753
HIGH
Navtor NavBox 4.12.0.3 and 4.14.1.2 - Unauthenticated Absolute Path Traversal
CVSS 7.5
CVE-2026-28414
HIGH
Gradio < 6.7.0 - Unauthenticated Absolute Path Traversal via Root-Relative Path Handling
CVSS 7.5
CVE-2026-27117
MEDIUM
bit7z < 4.0.11 - Path Traversal and Arbitrary File Write via Archive Extraction
CVSS 5.5
CVE-2026-26337
HIGH
Hyland Alfresco - Path Traversal & SSRF
CVSS 8.2
CVE-2026-1330
HIGH
MeetingHub < 2025-12-10 - Unauthenticated Arbitrary File Read via Absolute Path Traversal
CVSS 7.5
CVE-2026-1020
MEDIUM
Gotac Police Statistics Database System < 1.0.3 - Unauthenticated Absolute Path Traversal
CVSS 5.3
CVE-2026-1018
HIGH
Gotac Police Statistics Database System < 1.0.2 - Unauthenticated Arbitrary File Read via Absolute Path Traversal
CVSS 7.5
CVE-2026-20834
MEDIUM
Microsoft Windows Shell - Absolute Path Traversal Spoofing via Physical Attack
CVSS 4.6
CVE-2025-68472
HIGH
MindsDB < 25.11.1 - Unauthenticated Path Traversal and Arbitrary File Read via File Upload API
CVSS 8.1
CVE-2025-15237
MEDIUM
QOCA aim < 2.7.6 - Authenticated Absolute Path Traversal
CVSS 4.3
CVE-2025-15236
MEDIUM
QOCA aim < 2.7.6 - Authenticated Absolute Path Traversal
CVSS 4.3
Details
Vulnerabilities
126