CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
baseThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (12481)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-104286US | —OT kritisch | KEV | ||
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail… | ||||
| CVE-2026-93616US | —OT kritisch | KEV | ||
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. | ||||
| CVE-2026-85706US | —OT kritisch | KEV | ||
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2… | ||||
| CVE-2026-66384US | —OT kritisch | KEV | ||
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. | ||||
| CVE-2026-59310US | —OT kritisch | KEV | ||
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. | ||||
| CVE-2026-48282US | —OT kritisch | KEV | ||
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a… | ||||
| CVE-2026-20262US | —OT kritisch | KEV | ||
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the… | ||||
| CVE-2026-34909US | —OT kritisch | KEV | ||
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulat… | ||||
| CVE-2025-61624US | medium6.5OT kritisch | KEV | ||
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, Forti… | ||||
| CVE-2025-8110US | high8.8OT kritisch | KEV | ||
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | ||||
| CVE-2025-61884US | —OT kritisch | KEV | ||
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vu… | ||||
| CVE-2025-61882US | —OT kritisch | KEV | ||
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14… | ||||
| CVE-2025-25231US | —OT kritisch | Exploit | ||
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET re… | ||||
| CVE-2025-6218US | —OT kritisch | KEV | ||
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinR… | ||||
| CVE-2025-4632US | critical9.8OT kritisch | KEV | ||
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system au… | ||||
| CVE-2025-27920US | high8.8OT kritisch | KEV | ||
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sens… | ||||
| CVE-2025-34028US | critical10.0OT kritisch | KEV | ||
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vu… | ||||
| CVE-2025-2749US | —OT kritisch | KEV | ||
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path… | ||||
| CVE-2024-57728US | high7.2OT kritisch | KEV | ||
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This… | ||||
| CVE-2024-57727US | high7.5OT kritisch | KEV | ||
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary fil… | ||||
04
Angriffsmuster (5)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan