CWE-31 · File and Path Handling
Path Traversal: 'dir....filename'
16CVEs
SortMost likely exploited
16 CVEs with CWE-31 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-36857CheckJan v0.4.12 'readFileSync' - Path TraversalHomebrew · Jan · CVSS 7.5 · 2024-06-04 | 7.5 | 2.1% | 2024-06-04 |
| CVE-2024-2044Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4pgadmin.org · pgAdmin 4 · CVSS 9.9 · 2024-03-07 | 9.9 | 79% | 2024-03-07 |
| CVE-2024-24998A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.Ivanti · Avalanche · CVSS 8.8 · 2024-04-19 | 8.8 | 3.2% | 2024-04-19 |
| CVE-2024-28088LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended be…Langchain · Langchain · CVSS 8.1 · 2024-03-03 | 8.1 | 1.7% | 2024-03-03 |
| CVE-2024-35431ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indi…Zkteco · Zkbio Cvsecurity · CVSS 7.5 · 2024-05-30 | 7.5 | 1.0% | 2024-05-30 |
| CVE-2024-41376dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.Dzzoffice · Dzzoffice · CVSS 8.8 · 2024-08-05 | 8.8 | 1.0% | 2024-08-05 |
| CVE-2024-35429ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.Zkteco · Zkbio Cvsecurity · CVSS 6.5 · 2024-05-30 | 6.5 | 0.9% | 2024-05-30 |
| CVE-2024-22723Webtrees 2.1.18 is vulnerable to Directory Traversal. By manipulating the "media_folder" parameter in the URL, an attacker (in this case, an administrator) can navigate beyond the…Webtrees · Webtrees · CVSS 4.9 · 2024-02-28 | 4.9 | 0.9% | 2024-02-28 |
| CVE-2019-6268RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 allow URIs beginning with /.. for Directory Traversal, as demonstrated by reading /etc/shadow.No vendor recorded · CVSS 7.5 · 2024-03-08 | 7.5 | 0.8% | 2024-03-08 |
| CVE-2023-35860A Directory Traversal vulnerability in Modern Campus - Omni CMS 2023.1 allows a remote, unauthenticated attacker to enumerate file system information via the dir parameter to list…Moderncampus · Omni Cms · CVSS 5.3 · 2024-06-13 | 5.3 | 0.8% | 2024-06-13 |
| CVE-2024-25840In the module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a guest can download personal information w…Prestaworld · Account Manager · CVSS 7.5 · 2024-02-27 | 7.5 | 0.6% | 2024-02-27 |
| CVE-2026-94346PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 throu…Dell · PowerProtect Data Domain Virtual Edition · CVSS 7.2 · 2026-10-27 | 7.2 | 0.5% | 2026-10-27 |
| CVE-2026-104810Mitel MiVoice Office 400 File Management File Browser path traversal vulnerabilityMitel · Mitel MiVoice Office 400 · CVSS 8.4 · 2026-10-05 | 8.4 | 0.4% | 2026-10-05 |
| CVE-2026-108120path traversal inKoozali - SME Serverkoozali · SME Server · CVSS 7.7 · 2026-10-19 | 7.7 | 0.4% | 2026-10-19 |
| CVE-2026-104806Mitel MiVoice Office 400 System Logs Path Traversal Information DisclosureMitel · Mitel MiVoice Office 400 · CVSS 5.5 · 2026-10-05 | 5.5 | 0.3% | 2026-10-05 |
| CVE-2026-104706Mitel MiVoice Office 400 view system files path traversalMitel · Mitel MiVoice Office 400 · CVSS 8.4 · 2026-10-05 | 8.4 | 0.1% | 2026-10-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.