Skip to content
BackEsc
Sign in

CWE-24 · weakness in File and Path Handling

Path Traversal: '../filedir'

130 CVEs · 1 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1
check available
5
likely to be exploited
2

Every one of the 130 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sen…CVE-2025-27920Srimax · CVSS 7.2 · 1.9% likely

    Srimax

  2. Fortinet FortiSandbox - Path Traversal Authentication BypassCVE-2026-39813Fortinet · CVSS 9.1 · 44% likelycovered by CyberSIXT

    Fortinet

  3. EasySpider 0.6.2 - Arbitrary File ReadCVE-2024-6746NaiboWang · CVSS 4.3 · 3.3% likely
  4. esm.sh <= v136 - Arbitrary File Write via Path TraversalCVE-2025-59342esm-dev · CVSS 5.5 · 3.2% likely

    Esm-Dev

  5. XWiki Platform - Path TraversalCVE-2026-34151xwiki · CVSS 8.2 · 2.5% likely

    Xwiki

  6. Personal Weather Station Dashboard 12 - Directory TraversalCVE-2025-47423pwsdashboard · CVSS 5.8 · 2.0% likely
  7. A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an…CVE-2022-38129Keysight · CVSS 8.1 · 22% likely

    Keysight

  8. A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory…CVE-2025-60344D-Link · CVSS 8.6 · 11% likely

    D-Link

  9. Apache Hadoop Privilege escalation vulnerabilityCVE-2021-33036Apache Software Foundation · 4.0% likely

    Apache

  10. sjqzhang go-fastdfs File Upload uploa upload path traversalCVE-2023-1800sjqzhang · CVSS 7.3 · 3.6% likely
  11. KL-001-2025-016: Xorux LPAR2RRD File Upload Directory TraversalCVE-2025-54769Xorux · CVSS 8.8 · 3.6% likely

    Xorux

  12. GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath functionCVE-2020-9708Adobe · CVSS 5.9 · 2.9% likely

    Adobe

  13. Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voic…CVE-2024-43035Fonoster · CVSS 5.8 · 2.4% likely
  14. Undertow: directory traversal vulnerabilityCVE-2024-1459Redhat · CVSS 5.3 · 1.7% likely

    Red Hat

  15. Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Path Traversal VulnerabilityCVE-2022-20656Cisco · CVSS 6.5 · 1.7% likely

    Cisco

  16. Path Traversal at Discord-Recon .recon Command PathCVE-2021-29466DEMON1A · CVSS 6.5 · 1.6% likely

    DEMON1A

  17. An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbitrary code via ../ in…CVE-2024-53636Serosoft · CVSS 6.4 · 1.6% likely

    Serosoft

  18. ZipArchive::extractTo may extract outside of destination dirCVE-2021-21706PHP Group · CVSS 5.3 · 1.5% likely

    PHP

  19. Kubernetes Secrets Store CSI Driver plugin directory traversalsCVE-2020-8567Kubernetes · CVSS 4.9 · 1.5% likely

    Kubernetes

  20. Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP fileCVE-2026-14947Frauscher Sensortechnik · CVSS 7.2 · 1.5% likely

    Frauscher Sensortechnik

  21. GrowthBook account creation and file upload vulnerability in self-hosted configurationsCVE-2022-36065growthbook · CVSS 7.5 · 1.5% likely
  22. GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the priva…CVE-2025-43919GNU · CVSS 5.8 · 1.4% likely

    GNU

  23. Kubernetes Secrets Store CSI Driver sync/rotate directory traversalCVE-2020-8568Kubernetes · CVSS 5.8 · 1.3% likely

    Kubernetes

  24. anySign directory traversal vulnerabilityCVE-2020-7882Hancomwith · CVSS 7.5 · 1.3% likely
  25. Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as exploited in the wil…CVE-2023-53691Hikvision · CVSS 8.3 · 1.3% likely

    Hikvision

  26. Path Traversal: '../filedir' in Nuxt DevtoolsCVE-2024-23657nuxt · CVSS 8.8 · 1.2% likely

    Nuxt

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in