CWE-30 Path Traversal: '\dir\..\filename'
variantThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\dir\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (6)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-20393US | —OT critical | KEV | ||
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remot… | ||||
| CVE-2025-54386US | critical9.8 | — | ||
Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’… | ||||
| CVE-2004-0986US | high7.5 | — | ||
Iptables before 1.2.11, under certain conditions, does not properly load the required modules at system startup, which causes the firewall rules to fail to load and protect the sys… | ||||
| CVE-2017-3771US | high7.5 | — | ||
System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without completing BIOS/UEFI initialization proces… | ||||
| CVE-2017-3754US | medium6.7 | — | ||
Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a s… | ||||
| CVE-2026-79824US | — | — | ||
A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive. | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan