CWE-26 · File and Path Handling
Path Traversal: '/dir/../filename'
20CVEs
SortMost likely exploited
20 CVEs with CWE-26 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-20345A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affecte…Cisco · Cisco AppDynamics · CVSS 6.5 · 2024-03-06 | 6.5 | 2.2% | 2024-03-06 |
| CVE-2021-34762Cisco Firepower Management Center Software Authenticated Directory Traversal VulnerabilityCisco · Cisco Firepower Management Center · CVSS 8.1 · 2021-10-27 | 8.1 | 2.0% | 2021-10-27 |
| CVE-2021-42021A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3), Siveillance Video…Siemens · Siveillance Video DLNA Server · 2021-11-09 | – | 1.7% | 2021-11-09 |
| CVE-2023-50255Zip Path Traversal in Deepin-Compressorlinuxdeepin · developer-center · CVSS 9.3 · 2023-12-27 | 9.3 | 1.1% | 2023-12-27 |
| CVE-2024-29466Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component.No vendor recorded · CVSS 8.8 · 2024-04-30 | 8.8 | 1.0% | 2024-04-30 |
| CVE-2023-25802Roxy-WI has Path Traversal vulnerabilityhap-wi · roxy-wi · CVSS 7.5 · 2023-03-13 | 7.5 | 1.0% | 2023-03-13 |
| CVE-2026-15896Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path ParameterWebRehab · Super Forms – Drag & Drop Form Builder · CVSS 9.1 · 2026-10-02 | 9.1 | 0.9% | 2026-10-02 |
| CVE-2024-28064Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with disp…No vendor recorded · CVSS 9.8 · 2024-05-18 | 9.8 | 0.9% | 2024-05-18 |
| CVE-2025-25295Label Studio has a Path Traversal Vulnerability via image FieldHumanSignal · label-studio · CVSS 8.7 · 2025-02-14 | 8.7 | 0.8% | 2025-02-14 |
| CVE-2024-31551Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.Cmseasy · Cmseasy · CVSS 7.5 · 2024-04-26 | 7.5 | 0.7% | 2024-04-26 |
| CVE-2026-42196django-s3file: Relative path traversalcodingjoe · django-s3file · CVSS 9.9 · 2026-05-12 | 9.9 | 0.6% | 2026-05-12 |
| CVE-2026-76317Path Traversal through the Lookup Configuration REST API in Splunk EnterpriseSplunk · Splunk Enterprise · CVSS 8.8 · 2026-08-19 | 8.8 | 0.6% | 2026-08-19 |
| CVE-2025-53908RomM vulnerable to Authenticated Path Traversalrommapp · romm · CVSS 8.3 · 2025-07-16 | 8.3 | 0.5% | 2025-07-16 |
| CVE-2024-25466Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the…React-Native-Documents · Document Picker · CVSS 7.3 · 2024-02-16 | 7.3 | 0.5% | 2024-02-16 |
| CVE-2026-25575NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionalityTUM-Dev · NavigaTUM · CVSS 8.8 · 2026-02-04 | 8.8 | 0.5% | 2026-02-04 |
| CVE-2026-112904Vvveb: Path Traversal in nextRestore() and nextBackup()givanz · Vvveb · CVSS 8.7 · 2026-10-23 | 8.7 | 0.5% | 2026-10-23 |
| CVE-2024-5865Arbitrary File Reading in Centrify PASDelinea · Centrify PAS · CVSS 7.7 · 2024-07-02 | 7.7 | 0.5% | 2024-07-02 |
| CVE-2024-5866Arbitrary Directory Listing in Centrify PASDelinea · Centrify PAS · CVSS 5 · 2024-07-02 | 5.0 | 0.4% | 2024-07-02 |
| CVE-2022-45133Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A particularly structured XML file could allow one to traverse the…Mahara · Mahara · CVSS 6.5 · 2025-08-22 | 6.5 | 0.4% | 2025-08-22 |
| CVE-2026-46747A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFil…Siemens · SINEC INS · CVSS 4.3 · 2026-06-09 | 4.3 | 0.2% | 2026-06-09 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.