CWE-24 · File and Path Handling
Path Traversal: '../filedir'
130CVEs
SortMost likely exploited
130 CVEs with CWE-24 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-27920In CISA KEVExploitedOutput Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sen…Srimax · Output Messenger · CVSS 7.2 · 2025-05-05 | 7.2 | 1.9% | 2025-05-05 |
| CVE-2026-39813CheckFortinet FortiSandbox - Path Traversal Authentication BypassFortinet · FortiSandbox · CVSS 9.1 · 2026-04-14 | 9.1 | 44% | 2026-04-14 |
| CVE-2024-6746CheckEasySpider 0.6.2 - Arbitrary File ReadNaiboWang · EasySpider · CVSS 4.3 · 2024-07-15 | 4.3 | 3.3% | 2024-07-15 |
| CVE-2025-59342Checkesm.sh <= v136 - Arbitrary File Write via Path Traversalesm-dev · esm.sh · CVSS 5.5 · 2025-09-17 | 5.5 | 3.2% | 2025-09-17 |
| CVE-2026-34151CheckXWiki Platform - Path Traversalxwiki · xwiki-platform · CVSS 8.2 · 2026-09-14 | 8.2 | 2.5% | 2026-09-14 |
| CVE-2025-47423CheckPersonal Weather Station Dashboard 12 - Directory Traversalpwsdashboard · Personal Weather Station Dashboard · CVSS 5.8 · 2025-05-07 | 5.8 | 2.0% | 2025-05-07 |
| CVE-2022-38129A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an…Keysight · Keysight Technologies Sensor Management Server · CVSS 8.1 · 2022-08-10 | 8.1 | 22% | 2022-08-10 |
| CVE-2025-60344A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory…D-Link · DSR-150 · CVSS 8.6 · 2025-10-21 | 8.6 | 11% | 2025-10-21 |
| CVE-2021-33036Apache Hadoop Privilege escalation vulnerabilityApache Software Foundation · Apache Hadoop · 2022-06-15 | – | 4.0% | 2022-06-15 |
| CVE-2023-1800sjqzhang go-fastdfs File Upload uploa upload path traversalsjqzhang · go-fastdfs · CVSS 7.3 · 2023-04-02 | 7.3 | 3.6% | 2023-04-02 |
| CVE-2025-54769KL-001-2025-016: Xorux LPAR2RRD File Upload Directory TraversalXorux · LPAR2RRD · CVSS 8.8 · 2025-07-28 | 8.8 | 3.6% | 2025-07-28 |
| CVE-2020-9708GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath functionAdobe · Helix · CVSS 5.9 · 2020-08-14 | 5.9 | 2.9% | 2020-08-14 |
| CVE-2024-43035Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voic…Fonoster · Fonoster · CVSS 5.8 · 2026-03-05 | 5.8 | 2.4% | 2026-03-05 |
| CVE-2024-1459Undertow: directory traversal vulnerabilityRedhat · undertow · CVSS 5.3 · 2024-02-12 | 5.3 | 1.7% | 2024-02-12 |
| CVE-2022-20656Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Path Traversal VulnerabilityCisco · Cisco Evolved Programmable Network Manager (EPNM) · CVSS 6.5 · 2024-11-15 | 6.5 | 1.7% | 2024-11-15 |
| CVE-2021-29466Path Traversal at Discord-Recon .recon Command PathDEMON1A · Discord-Recon · CVSS 6.5 · 2021-04-22 | 6.5 | 1.6% | 2021-04-22 |
| CVE-2024-53636An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbitrary code via ../ in…Serosoft · Academia Student Information System · CVSS 6.4 · 2025-04-26 | 6.4 | 1.6% | 2025-04-26 |
| CVE-2021-21706ZipArchive::extractTo may extract outside of destination dirPHP Group · PHP · CVSS 5.3 · 2021-10-04 | 5.3 | 1.5% | 2021-10-04 |
| CVE-2020-8567Kubernetes Secrets Store CSI Driver plugin directory traversalsKubernetes · Kubernetes Secrets Store CSI Driver · CVSS 4.9 · 2021-01-21 | 4.9 | 1.5% | 2021-01-21 |
| CVE-2026-14947Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP fileFrauscher Sensortechnik · FDS 102 · CVSS 7.2 · 2026-08-20 | 7.2 | 1.5% | 2026-08-20 |
| CVE-2022-36065GrowthBook account creation and file upload vulnerability in self-hosted configurationsgrowthbook · growthbook · CVSS 7.5 · 2022-09-06 | 7.5 | 1.5% | 2022-09-06 |
| CVE-2025-43919GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the priva…GNU · Mailman · CVSS 5.8 · 2025-04-20 | 5.8 | 1.4% | 2025-04-20 |
| CVE-2020-8568Kubernetes Secrets Store CSI Driver sync/rotate directory traversalKubernetes · Kubernetes Secrets Store CSI Driver · CVSS 5.8 · 2021-01-21 | 5.8 | 1.3% | 2021-01-21 |
| CVE-2020-7882anySign directory traversal vulnerabilityHancomwith · anySign4PC · CVSS 7.5 · 2021-11-22 | 7.5 | 1.3% | 2021-11-22 |
| CVE-2023-53691Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as exploited in the wil…Hikvision · CSMP iSecure Center · CVSS 8.3 · 2025-10-22 | 8.3 | 1.3% | 2025-10-22 |
| CVE-2024-23657Path Traversal: '../filedir' in Nuxt Devtoolsnuxt · nuxt · CVSS 8.8 · 2024-08-05 | 8.8 | 1.2% | 2024-08-05 |
| CVE-2023-3057YFCMF Ajax.php path traversalIuok · YFCMF · CVSS 4.3 · 2023-06-02 | 4.3 | 1.2% | 2023-06-02 |
| CVE-2023-3056YFCMF index.php path traversalIuok · YFCMF · CVSS 4.3 · 2023-06-02 | 4.3 | 1.2% | 2023-06-02 |
| CVE-2024-0989Sichuan Yougou Technology KuERP Service.php del_sn_db path traversalSichuan Yougou Technology · KuERP · CVSS 5.4 · 2024-01-29 | 5.4 | 1.2% | 2024-01-29 |
| CVE-2024-4790DedeCMS path traversalDedecms · DedeCMS · CVSS 4.3 · 2024-05-11 | 4.3 | 1.1% | 2024-05-11 |
| CVE-2026-105314Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and i…Papermerge · Papermerge · CVSS 7.5 · 2026-10-05 | 7.5 | 1.1% | 2026-10-05 |
| CVE-2024-0417DeShang DSShop MemberAuth.php path traversalDeShang · DSShop · CVSS 5.4 · 2024-01-11 | 5.4 | 1.1% | 2024-01-11 |
| CVE-2021-26725Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4Nozomi Networks · Guardian · CVSS 7.2 · 2021-02-22 | 7.2 | 1.1% | 2021-02-22 |
| CVE-2022-29253Path Traversal in XWiki Platformxwiki · xwiki-platform · CVSS 2.7 · 2022-05-25 | 2.7 | 1.1% | 2022-05-25 |
| CVE-2023-52076Remote Code Execution Vulnerability in Atril's EPUB ebook parsingmate-desktop · atril · CVSS 8.5 · 2024-01-25 | 8.5 | 1.1% | 2024-01-25 |
| CVE-2023-6900rmountjoy92 DashMachine delete_file path traversalrmountjoy92 · DashMachine · CVSS 4.6 · 2023-12-17 | 4.6 | 1.1% | 2023-12-17 |
| CVE-2025-1599SourceCodester Best Church Management Software profile_crud.php path traversalSourceCodester · Best Church Management Software · CVSS 5.4 · 2025-02-24 | 5.4 | 1.1% | 2025-02-24 |
| CVE-2023-4171Chengdu Flash Flood Disaster Monitoring and Warning System FileDownload.ashx path traversalChengdu · Flash Flood Disaster Monitoring and Warning System · CVSS 4.3 · 2023-08-05 | 4.3 | 1.1% | 2023-08-05 |
| CVE-2026-108980Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerT…Blinko · Blinko · CVSS 8.8 · 2026-10-12 | 8.8 | 1.1% | 2026-10-12 |
| CVE-2026-97730In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an a…Netgate · pfSense Plus · CVSS 8.5 · 2026-09-25 | 8.5 | 1.0% | 2026-09-25 |
| CVE-2024-22079An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Directory traversal can occur via the system logs download mechanism.Elspec-Ltd · G5dfr Firmware · CVSS 7.5 · 2024-03-20 | 7.5 | 1.0% | 2024-03-20 |
| CVE-2024-12482cjbi wetech-cms Database Backup BackupFileUtil.java backup path traversalcjbi · wetech-cms · CVSS 4.3 · 2024-12-11 | 4.3 | 1.0% | 2024-12-11 |
| CVE-2023-1398XiaoBingBy TeaCMS upload path traversalXiaoBingBy · TeaCMS · CVSS 6.3 · 2023-03-14 | 6.3 | 1.0% | 2023-03-14 |
| CVE-2023-3240OTCMS usersNews_deal.php path traversalOtcms · OTCMS · CVSS 3.5 · 2023-06-14 | 3.5 | 1.0% | 2023-06-14 |
| CVE-2023-3239OTCMS path traversalOtcms · OTCMS · CVSS 3.5 · 2023-06-14 | 3.5 | 1.0% | 2023-06-14 |
| CVE-2024-3227Panwei eoffice OA Backend save_image.php path traversalPanwei · eoffice OA · CVSS 4.7 · 2024-04-03 | 4.7 | 1.0% | 2024-04-03 |
| CVE-2014-125033rails-cv-app uploaded_files_controller.rb path traversalRails-Cv-App Project · rails-cv-app · CVSS 3.5 · 2023-01-02 | 3.5 | 0.9% | 2023-01-02 |
| CVE-2024-0416DeShang DSMall MemberAuth.php path traversalDeShang · DSMall · CVSS 5.4 · 2024-01-11 | 5.4 | 0.9% | 2024-01-11 |
| CVE-2023-7134SourceCodester Medicine Tracking System path traversalSourceCodester · Medicine Tracking System · CVSS 6.3 · 2023-12-28 | 6.3 | 0.9% | 2023-12-28 |
| CVE-2025-43928In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerP…Infodraw · Media Relay Service · CVSS 5.8 · 2025-04-20 | 5.8 | 0.9% | 2025-04-20 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.