CWE-29 · File and Path Handling
Path Traversal: '..filename'
64CVEs
SortMost likely exploited
64 CVEs with CWE-29 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-6909CheckMlflow <2.9.2 - Path Traversalmlflow · mlflow/mlflow · CVSS 7.5 · 2023-12-18 | 7.5 | 90% | 2023-12-18 |
| CVE-2023-1177CheckMlflow <2.2.1 - Local File Inclusionmlflow · mlflow/mlflow · CVSS 9.3 · 2023-03-24 | 9.3 | 70% | 2023-03-24 |
| CVE-2024-6396CheckAimhubio Aim Server 3.19.3 - Arbitrary File Overwriteaimhubio · aimhubio/aim · CVSS 9.8 · 2024-07-12 | 9.8 | 53% | 2024-07-12 |
| CVE-2024-3848CheckMlflow < 2.11.0 - Path Traversalmlflow · mlflow/mlflow · CVSS 7.5 · 2024-05-16 | 7.5 | 43% | 2024-05-16 |
| CVE-2023-6021CheckRay API - Local File Inclusionray-project · ray-project/ray · CVSS 7.5 · 2023-11-16 | 7.5 | 37% | 2023-11-16 |
| CVE-2024-4322CheckLoLLMS WebUI < 9.8 - Path Traversalparisneo · parisneo/lollms-webui · CVSS 7.5 · 2024-05-16 | 7.5 | 31% | 2024-05-16 |
| CVE-2024-2928CheckMLflow < 2.11.3 - Path Traversalmlflow · mlflow/mlflow · CVSS 7.5 · 2024-06-06 | 7.5 | 22% | 2024-06-06 |
| CVE-2024-1561CheckGradio 4.3-4.12 - Local File Readgradio-app · gradio-app/gradio · CVSS 7.5 · 2024-04-16 | 7.5 | 9.3% | 2024-04-16 |
| CVE-2024-34470CheckHSC Mailinspector 5.2.17-3 through 5.2.18 - Local File InclusionHsclabs · Mailinspector · CVSS 8.6 · 2024-05-06 | 8.6 | 6.7% | 2024-05-06 |
| CVE-2023-2780CheckMlflow <2.3.1 - Local File Inclusion Bypassmlflow · mlflow/mlflow · CVSS 9.8 · 2023-05-17 | 9.8 | 6.3% | 2023-05-17 |
| CVE-2023-6977CheckMlflow <2.8.0 - Local File Inclusionmlflow · mlflow/mlflow · CVSS 10 · 2023-12-20 | 10.0 | 3.9% | 2023-12-20 |
| CVE-2023-6831Checkmlflow - Path Traversalmlflow · mlflow/mlflow · CVSS 8.1 · 2023-12-15 | 8.1 | 3.3% | 2023-12-15 |
| CVE-2023-6023CheckVertaAI ModelDB - Path Traversalvertaai · vertaai/modeldb · CVSS 8.6 · 2023-11-16 | 8.6 | 3.0% | 2023-11-16 |
| CVE-2024-8859CheckMlflow < 2.17.0 - Local File Inclusionmlflow · mlflow/mlflow · CVSS 7.5 · 2025-03-20 | 7.5 | 2.8% | 2025-03-20 |
| CVE-2024-4841CheckLoLLMS WebUI - Subfolder Prediction via Path Traversalparisneo · parisneo/lollms-webui · CVSS 4 · 2024-06-23 | 4.0 | 0.7% | 2024-06-23 |
| CVE-2024-2083Directory Traversal in zenml-io/zenmlzenml-io · zenml-io/zenml · CVSS 9.9 · 2024-04-16 | 9.9 | 37% | 2024-04-16 |
| CVE-2024-4320Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 9.8 · 2024-06-06 | 9.8 | 34% | 2024-06-06 |
| CVE-2024-3429Path Traversal in parisneo/lollmsparisneo · parisneo/lollms · CVSS 9.8 · 2024-06-06 | 9.8 | 28% | 2024-06-06 |
| CVE-2023-1034Path Traversal: '\..\filename' in salesagility/suitecrmsalesagility · salesagility/suitecrm · CVSS 4.3 · 2023-02-25 | 4.3 | 26% | 2023-02-25 |
| CVE-2024-13059Path Traversal in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm · CVSS 7.2 · 2025-02-10 | 7.2 | 24% | 2025-02-10 |
| CVE-2023-0104The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of th…Weintek · EasyBuilder Pro cMT · CVSS 9.3 · 2023-02-22 | 9.3 | 22% | 2023-02-22 |
| CVE-2024-21518This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path,…Opencart · opencart/opencart · CVSS 7.2 · 2024-06-22 | 7.2 | 14% | 2024-06-22 |
| CVE-2023-6975Path Traversal: '\..\filename'mlflow · mlflow/mlflow · CVSS 9.8 · 2023-12-20 | 9.8 | 2.0% | 2023-12-20 |
| CVE-2024-2360Path Traversal leading to Remote Code Execution in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 9.8 · 2024-06-06 | 9.8 | 1.9% | 2024-06-06 |
| CVE-2024-11170Path Traversal in danny-avila/librechatdanny-avila · danny-avila/librechat · CVSS 8.8 · 2025-03-20 | 8.8 | 1.8% | 2025-03-20 |
| CVE-2024-12389Path Traversal in binary-husky/gpt_academicbinary-husky · binary-husky/gpt_academic · CVSS 8.8 · 2025-03-20 | 8.8 | 1.7% | 2025-03-20 |
| CVE-2024-2624Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 9.4 · 2024-06-06 | 9.4 | 1.3% | 2024-06-06 |
| CVE-2024-5443Remote Code Execution via Path Traversal in parisneo/lollmsparisneo · parisneo/lollms · CVSS 9.8 · 2024-06-22 | 9.8 | 1.2% | 2024-06-22 |
| CVE-2024-21542Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extrac…luigi · CVSS 8.6 · 2024-12-10 | 8.6 | 1.1% | 2024-12-10 |
| CVE-2024-2358Path Traversal leading to Remote Code Execution in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 9.8 · 2024-05-16 | 9.8 | 1.1% | 2024-05-16 |
| CVE-2024-5211Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm · CVSS 9.1 · 2024-06-12 | 9.1 | 1.0% | 2024-06-12 |
| CVE-2024-8537Path Traversal in modelscope/agentscopemodelscope · modelscope/agentscope · CVSS 9.1 · 2025-03-20 | 9.1 | 1.0% | 2025-03-20 |
| CVE-2023-6130Path Traversal: '\..\filename' in salesagility/suitecrmsalesagility · salesagility/suitecrm · CVSS 7.5 · 2023-11-14 | 7.5 | 1.0% | 2023-11-14 |
| CVE-2024-7957Arbitrary File Overwrite in danswer-ai/danswerdanswer-ai · danswer-ai/danswer · CVSS 9.1 · 2025-03-20 | 9.1 | 1.0% | 2025-03-20 |
| CVE-2024-2914TarSlip Vulnerability in deepjavalibrary/djldeepjavalibrary · deepjavalibrary/djl · CVSS 7.8 · 2024-06-06 | 7.8 | 0.9% | 2024-06-06 |
| CVE-2024-8248Path Traversal in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm · CVSS 7.2 · 2025-03-20 | 7.2 | 0.9% | 2025-03-20 |
| CVE-2024-2356Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 9.6 · 2026-02-02 | 9.6 | 0.9% | 2026-02-02 |
| CVE-2024-5926Path Traversal in stitionai/devikastitionai · stitionai/devika · CVSS 9.1 · 2024-06-30 | 9.1 | 0.9% | 2024-06-30 |
| CVE-2023-2984Path Traversal: '\..\filename' in pimcore/pimcorepimcore · pimcore/pimcore · CVSS 6.3 · 2023-05-30 | 6.3 | 0.9% | 2023-05-30 |
| CVE-2024-3435Path Traversal in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 8.4 · 2024-05-16 | 8.4 | 0.8% | 2024-05-16 |
| CVE-2026-5627Path Traversal in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm · CVSS 9.1 · 2026-04-07 | 9.1 | 0.8% | 2026-04-07 |
| CVE-2024-8982Local File Inclusion in bentoml/openllmbentoml · bentoml/openllm · CVSS 6.2 · 2025-03-20 | 6.2 | 0.8% | 2025-03-20 |
| CVE-2024-7962Arbitrary File Read via Insufficient Validation in gaizhenbiao/chuanhuchatgptgaizhenbiao · gaizhenbiao/chuanhuchatgpt · CVSS 7.5 · 2024-10-29 | 7.5 | 0.8% | 2024-10-29 |
| CVE-2026-24217NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file. A successful exploit of this vulnerability might lead…NVIDIA · BioNeMo Framework · CVSS 8.8 · 2026-05-20 | 8.8 | 0.8% | 2026-05-20 |
| CVE-2023-0316Path Traversal: '\..\filename' in froxlor/froxlorfroxlor · froxlor/froxlor · CVSS 6.8 · 2023-01-16 | 6.8 | 0.8% | 2023-01-16 |
| CVE-2024-3573Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflowmlflow · mlflow/mlflow · CVSS 9.3 · 2024-04-16 | 9.3 | 0.7% | 2024-04-16 |
| CVE-2024-10648Path Traversal in gradio-app/gradiogradio-app · gradio-app/gradio · CVSS 8.2 · 2025-03-20 | 8.2 | 0.7% | 2025-03-20 |
| CVE-2024-2361Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 9.6 · 2024-05-16 | 9.6 | 0.6% | 2024-05-16 |
| CVE-2025-6209Arbitrary File Read through Path Traversal in run-llama/llama_indexrun-llama · run-llama/llama_index · CVSS 7.5 · 2025-07-07 | 7.5 | 0.6% | 2025-07-07 |
| CVE-2025-50184DbGate allows for File Traversal via file parameterdbgate · dbgate · CVSS 7.1 · 2025-07-26 | 7.1 | 0.6% | 2025-07-26 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.