CWE-26 · weakness in File and Path Handling
Path Traversal: '/dir/../filename'
20 CVEs
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.
- A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affecte…
- Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability
- A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3), Siveillance Video…
- Zip Path Traversal in Deepin-Compressor
- Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component.
- Roxy-WI has Path Traversal vulnerability
- Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
- Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with disp…
- Label Studio has a Path Traversal Vulnerability via image Field
- Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.
- django-s3file: Relative path traversal
- Path Traversal through the Lookup Configuration REST API in Splunk Enterprise
- RomM vulnerable to Authenticated Path Traversal
- Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the…
- NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality
- Vvveb: Path Traversal in nextRestore() and nextBackup()
- Arbitrary File Reading in Centrify PAS
- Arbitrary Directory Listing in Centrify PAS
- Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A particularly structured XML file could allow one to traverse the…
- A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFil…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.