recorded together · two weakness classes
Server-Side Request Forgery and File and Path Handling
55 CVEs · 1 exploited
55 CVEs name a weakness of both Server-Side Request Forgery and File and Path Handling, 1.2× what chance alone would give (about 45). The pairing most often behind it is CWE-918 (Server-Side Request Forgery) with CWE-22 (Path Traversal), in 27 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 55
- Chance alone would give
- about 45
- So they are recorded together
- 1.2× more often than chance
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial from 25 CVEs and 1.15 times chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
- exploited in the wild
- 1
- check available
- 1
Every one of the 55 is a mark on the map. Named now: 1 to 26, most at risk first.
- Oracle E-Business Suite - Server-Side Request Forgery
- elFinder 2.1.58 - Remote Code Execution
- Streama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File Write
- Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
- Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme
- Butterfly has path/URL confusion in resource handling leading to multiple weaknesses
- Server-side file-write and request forgery via spatial lookups
- Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal.
- spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.…
- Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet
- UnForm Server < 10.1.15 Doc Flow Unauthenticated File Read
- Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on th…
- WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.
- Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator
- The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and…
- RabbitMQ: UNC SSRF affecting the management UI on Windows
- Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet
- Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}
- WordPress ICS Calendar plugin <= 10.12.0.3 - SSRF and Arbitrary File Read vulnerability
- Wallos: SSRF via url parameter leading to File Traversal
- SolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak
- Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
- datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
- GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
- The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to read or write to server files via a cra…
- oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.