Skip to content

CWE-26 · weakness in File and Path Handling

Path Traversal: '/dir/../filename'

20 CVEs

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.

  1. A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affecte…CVE-2024-20345Cisco · CVSS 6.5 · 2.2% likely

    Cisco

  2. Cisco Firepower Management Center Software Authenticated Directory Traversal VulnerabilityCVE-2021-34762Cisco · CVSS 8.1 · 2.0% likely

    Cisco

  3. A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3), Siveillance Video…CVE-2021-42021Siemens · 1.7% likely

    Siemens

  4. Zip Path Traversal in Deepin-CompressorCVE-2023-50255linuxdeepin · CVSS 9.3 · 1.1% likely
  5. Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component.CVE-2024-29466CVSS 8.8 · 1.0% likely
  6. Roxy-WI has Path Traversal vulnerabilityCVE-2023-25802hap-wi · CVSS 7.5 · 1.0% likely

    Hap-Wi

  7. Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path ParameterCVE-2026-15896WebRehab · CVSS 9.1 · 0.9% likely

    WebRehab

  8. Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with disp…CVE-2024-28064CVSS 9.8 · 0.9% likely
  9. Label Studio has a Path Traversal Vulnerability via image FieldCVE-2025-25295HumanSignal · CVSS 8.7 · 0.8% likely

    HumanSignal

  10. Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.CVE-2024-31551Cmseasy · CVSS 7.5 · 0.7% likely

    Cmseasy

  11. django-s3file: Relative path traversalCVE-2026-42196codingjoe · CVSS 9.9 · 0.6% likely
  12. Path Traversal through the Lookup Configuration REST API in Splunk EnterpriseCVE-2026-76317Splunk · CVSS 8.8 · 0.6% likely

    Splunk

  13. RomM vulnerable to Authenticated Path TraversalCVE-2025-53908rommapp · CVSS 8.3 · 0.5% likely

    Rommapp

  14. Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the…CVE-2024-25466React-Native-Documents · CVSS 7.3 · 0.5% likely
  15. NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionalityCVE-2026-25575TUM-Dev · CVSS 8.8 · 0.5% likely
  16. Vvveb: Path Traversal in nextRestore() and nextBackup()CVE-2026-112904givanz · CVSS 8.7 · 0.5% likely

    Givanz

  17. Arbitrary File Reading in Centrify PASCVE-2024-5865Delinea · CVSS 7.7 · 0.5% likely

    Delinea

  18. Arbitrary Directory Listing in Centrify PASCVE-2024-5866Delinea · CVSS 5 · 0.4% likely

    Delinea

  19. Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A particularly structured XML file could allow one to traverse the…CVE-2022-45133Mahara · CVSS 6.5 · 0.4% likely

    Mahara

  20. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFil…CVE-2026-46747Siemens · CVSS 4.3 · 0.2% likely

    Siemens

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in