CWE-36
Absolute Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
130 vulnerabilities with CWE-36
CVE-2026-13346
MEDIUM
pip absolute path traversal during download from malicious package indexes
CVE-2026-13189
HIGH
SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX
CVSS 7.5
CVE-2026-57211
MEDIUM
RabbitMQ: UNC SSRF affecting the management UI on Windows
CVSS 6.5
CVE-2026-15302
MEDIUM
ARMember <= 4.0.27 - Unauthenticated Directory Traversal
CVSS 5.3
CVE-2026-58300
MEDIUM
Microsoft Edge for Android Information Disclosure Vulnerability
CVSS 6.2
CVE-2026-49290
HIGH
Slopsmith < 0.2.9-alpha.5 - Path Traversal Arbitrary File Write
CVE-2026-53698
MEDIUM
Silverpeas < 6.4.6 - Absolute Path Traversal
CVSS 6.5
CVE-2026-10075
MEDIUM
Interinfo｜DreamMaker - Path Traversal
CVSS 5.3
CVE-2026-10044
HIGH
ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/
CVSS 7.5
CVE-2026-32997
HIGH
Veeam Backup And Replication < 13.0.1 - Absolute Path Traversal
CVE-2026-4782
MEDIUM
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
CVSS 6.5
CVE-2026-32175
MEDIUM
.NET 10.0 < 10.0.8, 9.0 < 9.0.16, 8.0 < 8.0.27 - Path Traversal and Arbitrary File Write
CVSS 4.3
CVE-2026-42315
HIGH
pyLoad: Path Traversal via Package Folder Name in set_package_data
CVSS 8.1
CVE-2026-6418
MEDIUM
PaperCut NG/MF: Path Traversal in Shared Account Synchronization
CVSS 4.9
CVE-2026-44029
MEDIUM
Nix 2.24.7-2.34.6 - Arbitrary File Write via Directory Traversal in nix-prefetch-url and nix store prefetch-file
CVSS 5.3
CVE-2026-7217
MEDIUM
Deepractice PromptX Document File index.ts read_pdf absolute path traversal
CVSS 5.3
CVE-2026-35465
HIGH
SecureDrop Client has path injection in read_gzip_header_filename()
CVSS 7.5
CVE-2026-34515
HIGH
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
CVSS 7.5
CVE-2026-4373
HIGH
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
CVSS 7.5
CVE-2026-0846
HIGH
nltk < 3.9.3 - Arbitrary File Read via filestring() Function
CVSS 7.5
CVE-2026-2753
HIGH
Navtor NavBox 4.12.0.3 and 4.14.1.2 - Unauthenticated Absolute Path Traversal
CVSS 7.5
CVE-2026-28414
HIGH
Gradio < 6.7.0 - Unauthenticated Absolute Path Traversal via Root-Relative Path Handling
CVSS 7.5
CVE-2026-27117
MEDIUM
bit7z < 4.0.11 - Path Traversal and Arbitrary File Write via Archive Extraction
CVSS 5.5
CVE-2026-26337
HIGH
Hyland Alfresco - Path Traversal & SSRF
CVSS 8.2
CVE-2026-1330
HIGH
MeetingHub < 2025-12-10 - Unauthenticated Arbitrary File Read via Absolute Path Traversal
CVSS 7.5
Details
Vulnerabilities
130