CWE-36 Absolute Path Traversal
baseThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (158)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-48248US | high8.6OT kritisch | KEV | ||
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the… | ||||
| CVE-2024-13161US | high7.5OT kritisch | KEV | ||
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensit… | ||||
| CVE-2024-13160US | high7.5OT kritisch | KEV | ||
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensit… | ||||
| CVE-2024-13159US | high7.5OT kritisch | KEV | ||
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensit… | ||||
| CVE-2018-20250US | high7.8OT kritisch | KEV | ||
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field i… | ||||
| CVE-2023-3765US | critical10.0 | — | ||
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. | ||||
| CVE-2025-57790US | high8.8 | Exploit | ||
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to r… | ||||
| CVE-2025-68472US | critical9.1 | Exploit | ||
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller… | ||||
| CVE-2025-34392US | critical9.8 | — | ||
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by… | ||||
| CVE-2024-32004US | high7.8 | Exploit | ||
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when… | ||||
| CVE-2026-57211US | critical10.0 | — | ||
RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded ba… | ||||
| CVE-2021-24375US | critical9.8 | — | ||
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.… | ||||
| CVE-2024-51549US | critical9.4 | — | ||
Absolute File Traversal vulnerabilities allows access and modification of un-intended resources.
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
M… | ||||
| CVE-2025-53392US | medium6.5 | Exploit | ||
In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's pers… | ||||
| CVE-2024-47883US | critical9.1 | — | ||
The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer to (what are expected… | ||||
| CVE-2026-89009US | critical9.1 | — | ||
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite… | ||||
| CVE-2026-47606US | critical9.1 | — | ||
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and in… | ||||
| CVE-2024-2362US | critical9.1 | — | ||
A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environme… | ||||
| CVE-2026-83784US | high8.8 | — | ||
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70297US | high8.8 | — | ||
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network. | ||||
04
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan