CWE-35 Path Traversal: '.../...//'
variantThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (289)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-85706US | —OT critical | KEV | ||
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2… | ||||
| CVE-2025-8088US | high8.8OT critical | KEV | ||
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was ex… | ||||
| CVE-2024-2863US | critical9.8 | — | ||
This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. | ||||
| CVE-2020-27130US | critical9.1 | — | ||
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation o… | ||||
| CVE-2023-32714US | high8.1 | — | ||
In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be u… | ||||
| CVE-2019-7267US | critical9.8 | — | ||
Linear eMerge 50P/5000P devices allow Cookie Path Traversal. | ||||
| CVE-2024-36991US | high7.5 | Exploit | ||
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Wind… | ||||
| CVE-2025-68428US | high7.5 | Exploit | ||
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusio… | ||||
| CVE-2020-5421US | medium6.5 | Exploit | ||
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 m… | ||||
| CVE-2018-3744US | critical9.8 | — | ||
The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL. | ||||
| CVE-2026-45495US | critical9.8 | — | ||
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | ||||
| CVE-2025-49297US | critical9.8 | — | ||
Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6. | ||||
| CVE-2025-49296US | critical9.8 | — | ||
Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <= 1.6. | ||||
| CVE-2025-49295US | critical9.8 | — | ||
Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a through <= 2.1. | ||||
| CVE-2024-39171US | critical9.8 | — | ||
Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statements to .htaccess and c… | ||||
| CVE-2012-0246US | high9.3 | — | ||
Directory traversal vulnerability in an unspecified ActiveX control in Ecava IntegraXor before 3.71.4200 allows remote attackers to execute arbitrary code via vectors involving an… | ||||
| CVE-1999-0959US | high7.2 | Exploit | ||
IRIX startmidi program allows local users to modify arbitrary files via a symlink attack. | ||||
| CVE-2025-24786US | critical9.1 | — | ||
WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in pla… | ||||
| CVE-2026-44415DE | critical9.1 | — | ||
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal… | ||||
| CVE-2023-46690US | high8.8 | — | ||
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, which could lead to re… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan