CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
baseThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (12481)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-104286US | —OT critical | KEV | ||
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail… | ||||
| CVE-2026-93616US | —OT critical | KEV | ||
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. | ||||
| CVE-2026-85706US | —OT critical | KEV | ||
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2… | ||||
| CVE-2026-66384US | —OT critical | KEV | ||
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. | ||||
| CVE-2026-59310US | —OT critical | KEV | ||
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. | ||||
| CVE-2026-48282US | —OT critical | KEV | ||
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a… | ||||
| CVE-2026-20262US | —OT critical | KEV | ||
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the… | ||||
| CVE-2026-34909US | —OT critical | KEV | ||
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulat… | ||||
| CVE-2025-61624US | medium6.5OT critical | KEV | ||
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, Forti… | ||||
| CVE-2025-8110US | high8.8OT critical | KEV | ||
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | ||||
| CVE-2025-61884US | —OT critical | KEV | ||
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vu… | ||||
| CVE-2025-61882US | —OT critical | KEV | ||
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14… | ||||
| CVE-2025-25231US | —OT critical | Exploit | ||
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET re… | ||||
| CVE-2025-6218US | —OT critical | KEV | ||
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinR… | ||||
| CVE-2025-4632US | critical9.8OT critical | KEV | ||
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system au… | ||||
| CVE-2025-27920US | high8.8OT critical | KEV | ||
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sens… | ||||
| CVE-2025-34028US | critical10.0OT critical | KEV | ||
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vu… | ||||
| CVE-2025-2749US | —OT critical | KEV | ||
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path… | ||||
| CVE-2024-57728US | high7.2OT critical | KEV | ||
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This… | ||||
| CVE-2024-57727US | high7.5OT critical | KEV | ||
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary fil… | ||||
04
attack patterns (5)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan