CWE-24 Path Traversal: '../filedir'
variantThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (130)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-27920US | high8.8OT critical | KEV | ||
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sens… | ||||
| CVE-2022-38129US | critical9.8 | — | ||
A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an u… | ||||
| CVE-2020-7882US | critical9.1 | Exploit | ||
Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains pa… | ||||
| CVE-2023-52076US | high7.8 | Exploit | ||
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril… | ||||
| CVE-2024-53636US | critical9.8 | — | ||
An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbitrary code via ../ in… | ||||
| CVE-2025-43919US | high7.5 | Exploit | ||
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the privat… | ||||
| CVE-2023-1800US | critical9.8 | — | ||
A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the… | ||||
| CVE-2025-43928US | critical9.8 | — | ||
In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerPa… | ||||
| CVE-2024-2563US | critical9.8 | — | ||
A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upl… | ||||
| CVE-2024-0989US | critical9.8 | — | ||
A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this issue is the function del_sn_db of the file /a… | ||||
| CVE-2024-0417US | critical9.8 | — | ||
A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controller/MemberAuth.php. The… | ||||
| CVE-2024-0416US | critical9.8 | — | ||
A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the file application/home/c… | ||||
| CVE-2023-7134US | critical9.8 | — | ||
A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argumen… | ||||
| CVE-2023-7058US | critical9.8 | — | ||
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The… | ||||
| CVE-2023-3057US | critical9.8 | — | ||
A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipula… | ||||
| CVE-2023-3056US | critical9.8 | — | ||
A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file index.php. The manipulation leads to path t… | ||||
| CVE-2026-21857US | medium6.5 | Exploit | ||
REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal… | ||||
| CVE-2025-61318US | critical9.1 | — | ||
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perfo… | ||||
| CVE-2025-1599US | critical9.1 | — | ||
A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… | ||||
| CVE-2025-1588US | critical9.1 | — | ||
A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/manage-nurse.php.… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan