CWE-27 · File and Path Handling
Path Traversal: 'dir/../../filename'
29CVEs
SortMost likely exploited
29 CVEs with CWE-27 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-23897In CISA KEVExploitedJenkins < 2.441 - Arbitrary File ReadJenkins Project · Jenkins · CVSS 9.8 · 2024-01-24 | 9.8 | 100% | 2024-01-24 |
| CVE-2024-24809CheckTraccar - Unrestricted File Uploadtraccar · traccar · CVSS 8.5 · 2024-04-10 | 8.5 | 54% | 2024-04-10 |
| CVE-2023-34125Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges. This issue affects…SonicWall · GMS · 2023-07-13 | – | 24% | 2023-07-13 |
| CVE-2022-24785Path Traversal in Moment.jsmoment · moment · CVSS 7.5 · 2022-04-04 | 7.5 | 14% | 2022-04-04 |
| CVE-2023-50254Deepin Reader RCE vulnerability due to a design flawlinuxdeepin · developer-center · CVSS 9.3 · 2023-12-22 | 9.3 | 2.1% | 2023-12-22 |
| CVE-2021-35027A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information.Zyxel · ZyWALL VPN2S Firmware · CVSS 7.5 · 2021-09-29 | 7.5 | 2.0% | 2021-09-29 |
| CVE-2023-27588Unauthenticated path traversal vulnerability in Hasura GraphQL Enginehasura · graphql-engine · CVSS 7.5 · 2023-03-14 | 7.5 | 1.3% | 2023-03-14 |
| CVE-2024-21896The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the impleme…NodeJS · Node · CVSS 7.9 · 2024-02-20 | 7.9 | 1.3% | 2024-02-20 |
| CVE-2025-66518Apache Kyuubi: Unauthorized directory access due to missing path normalizationApache Software Foundation · Apache Kyuubi · CVSS 8.8 · 2026-01-05 | 8.8 | 1.0% | 2026-01-05 |
| CVE-2024-27764An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.Jeewms · Jeewms · CVSS 9.8 · 2024-03-05 | 9.8 | 1.0% | 2024-03-05 |
| CVE-2023-20129Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager VulnerabilitiesCisco · Cisco Prime Infrastructure · CVSS 6.5 · 2023-04-05 | 6.5 | 0.9% | 2023-04-05 |
| CVE-2023-20127Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager VulnerabilitiesCisco · Cisco Prime Infrastructure · CVSS 6.5 · 2023-04-05 | 6.5 | 0.9% | 2023-04-05 |
| CVE-2024-51747Arbitrary File Read and Delete in kanboardkanboard · kanboard · CVSS 9.1 · 2024-11-11 | 9.1 | 0.8% | 2024-11-11 |
| CVE-2024-7458elunez eladmin Database Management/Deployment Management upload path traversalelunez · eladmin · CVSS 5.5 · 2024-08-04 | 5.5 | 0.8% | 2024-08-04 |
| CVE-2024-20348A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbi…Cisco · Cisco Data Center Network Manager · CVSS 7.5 · 2024-04-03 | 7.5 | 0.8% | 2024-04-03 |
| CVE-2026-62391Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliasesApache Software Foundation · Apache Kyuubi · CVSS 8.1 · 2026-07-31 | 8.1 | 0.8% | 2026-07-31 |
| CVE-2026-24457An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation c…Eclipse Foundation · Eclipse OpenMQ · CVSS 9.1 · 2026-03-05 | 9.1 | 0.7% | 2026-03-05 |
| CVE-2025-58761Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`Tautulli · Tautulli · CVSS 8.6 · 2025-09-09 | 8.6 | 0.7% | 2025-09-09 |
| CVE-2024-25828cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.Cmseasy · Cmseasy · CVSS 4.9 · 2024-02-22 | 4.9 | 0.6% | 2024-02-22 |
| CVE-2023-20131Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager VulnerabilitiesCisco · Cisco Prime Infrastructure · CVSS 6.5 · 2023-04-05 | 6.5 | 0.6% | 2023-04-05 |
| CVE-2024-43658Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.Iocharger · Iocharger firmware for AC models · CVSS 7.2 · 2025-01-09 | 7.2 | 0.6% | 2025-01-09 |
| CVE-2026-17495moment vulnerable to Path Traversal via crafted non-string locale namemoment · moment · CVSS 5.9 · 2026-09-15 | 5.9 | 0.5% | 2026-09-15 |
| CVE-2025-52237An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal.Sscms · Sscms · CVSS 6.5 · 2025-08-05 | 6.5 | 0.5% | 2025-08-05 |
| CVE-2026-20018Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal VulnerabilityCisco · Cisco Secure Firewall Management Center (FMC) · CVSS 5.9 · 2026-03-04 | 5.9 | 0.5% | 2026-03-04 |
| CVE-2025-10438Path Traversal in Yordam BT's Yordam KatalogYordam Information Technology Consulting Education and Elec… · Yordam Katalog · CVSS 8.6 · 2025-09-25 | 8.6 | 0.4% | 2025-09-25 |
| CVE-2026-76344Path Traversal through the Search Dispatch REST API in Splunk EnterpriseSplunk · Splunk Enterprise · CVSS 7.7 · 2026-08-19 | 7.7 | 0.4% | 2026-08-19 |
| CVE-2023-20130Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager VulnerabilitiesCisco · Cisco Prime Infrastructure · CVSS 6.5 · 2023-04-05 | 6.5 | 0.4% | 2023-04-05 |
| CVE-2023-20090Cisco TelePresence Collaboration Endpoint and RoomOS Software Privilege Escalation VulnerabilityCisco · Cisco RoomOS Software · CVSS 6.7 · 2024-11-15 | 6.7 | 0.2% | 2024-11-15 |
| CVE-2025-58292Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.Huawei · HarmonyOS · CVSS 3.3 · 2025-10-11 | 3.3 | 0.1% | 2025-10-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.