CWE-29 · weakness in File and Path Handling
Path Traversal: '..filename'
64 CVEs
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- check available
- 15
- likely to be exploited
- 7
Every one of the 64 is a mark on the map. Named now: 1 to 26, most at risk first.
- Mlflow <2.9.2 - Path Traversal
- Mlflow <2.2.1 - Local File Inclusion
- Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
- Mlflow < 2.11.0 - Path Traversal
- Ray API - Local File Inclusion
- LoLLMS WebUI < 9.8 - Path Traversal
- MLflow < 2.11.3 - Path Traversal
- Gradio 4.3-4.12 - Local File Read
- HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion
- Mlflow <2.3.1 - Local File Inclusion Bypass
- Mlflow <2.8.0 - Local File Inclusion
- mlflow - Path Traversal
- VertaAI ModelDB - Path Traversal
- Mlflow < 2.17.0 - Local File Inclusion
- LoLLMS WebUI - Subfolder Prediction via Path Traversal
- Directory Traversal in zenml-io/zenml
- Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui
- Path Traversal in parisneo/lollms
- Path Traversal: '\..\filename' in salesagility/suitecrm
- Path Traversal in mintplex-labs/anything-llm
- The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of th…
- This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path,…
- Path Traversal: '\..\filename'
- Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- Path Traversal in danny-avila/librechat
- Path Traversal in binary-husky/gpt_academic
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.