CWE-27 · weakness in File and Path Handling
Path Traversal: 'dir/../../filename'
29 CVEs · 1 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 1
- check available
- 1
- likely to be exploited
- 2
Every one of the 29 is a mark on the map. Named now: 1 to 26, most at risk first.
- Jenkins < 2.441 - Arbitrary File Read
- Traccar - Unrestricted File Upload
- Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges. This issue affects…
- Path Traversal in Moment.js
- Deepin Reader RCE vulnerability due to a design flaw
- A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information.
- Unauthenticated path traversal vulnerability in Hasura GraphQL Engine
- The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the impleme…
- Apache Kyuubi: Unauthorized directory access due to missing path normalization
- An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.
- Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities
- Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities
- Arbitrary File Read and Delete in kanboard
- elunez eladmin Database Management/Deployment Management upload path traversal
- A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbi…
- Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases
- An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation c…
- Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`
- cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.
- Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities
- Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.
- moment vulnerable to Path Traversal via crafted non-string locale name
- An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal.
- Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal Vulnerability
- Path Traversal in Yordam BT's Yordam Katalog
- Path Traversal through the Search Dispatch REST API in Splunk Enterprise
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.