weakness in File and Path Handling
Path Traversal
249 disclosed reports · $139,549 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
- reports
- 249
- paid a bounty
- 43
Every one of the 249 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Arbitrary file read via the UploadsRewriter when moving and issue
- Arbitrary file read via the bulk imports UploadsPipeline
- Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted data
- Arbitrary file read during project import
- Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling
- Path traversal in filename in LINE Mac client
- Mozilla VPN Clients: RCE via file write and path traversal
- RCE as Admin defeats WordPress hardening and file permissions
- [portswigger.net] Path Traversal al /cms/audioitems
- Path Traversal Vulnerability in Lila Project
- Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file read
- Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
- Path traversal in Nuget Package Registry
- Avatar upload allows arbitrary file overwriting
- Vanilla Forums AddonManager getSingleIndex Directory Traversal File Inclusion Remote Code Execution Vulnerability
- Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/
- File writing by Directory traversal at actionpack-page_caching and RCE by it
- PUT Based CSRF via Client Side Path Traversal + Cookie Bomb on Acronis Cloud
- Path traversal lead to LFR via [CVE-2019-3394]
- CVE-2020-3187 - Unauthenticated Arbitrary File Deletion
- Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/`
- LFI to steal /etc/passwd - Bypass filter in the <meta property="og:image"> tag via redirect and much more
- jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`
- Path traversal by monkey-patching Buffer internals
- Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)
- Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.