CWE-35 · File and Path Handling
Path Traversal: '.../...//'
201CVEs
1exploited
5with a public check
3likely (EPSS 10%+)
SortMost likely exploited
201 CVEs with CWE-35 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-8088In CISA KEVExploitedPath traversal vulnerability in WinRARwin.rar GmbH · WinRAR · CVSS 8.4 · 2025-08-08 | 8.4 | 94% | 2025-08-08 |
| CVE-2024-2863CheckLG LED Assistant - Thumbnail Path Traversal File UploadLG Electronics · LG LED Assistant · CVSS 5.3 · 2024-03-25 | 5.3 | 64% | 2024-03-25 |
| CVE-2024-36991CheckSplunk Enterprise - Local File InclusionSplunk · Splunk Enterprise · CVSS 7.5 · 2024-07-01 | 7.5 | 13% | 2024-07-01 |
| CVE-2020-26073CheckCisco SD-WAN vManage Software - Local File InclusionCisco · Cisco Catalyst SD-WAN Manager · CVSS 7.5 · 2024-11-18 | 7.5 | 13% | 2024-11-18 |
| CVE-2025-24786CheckWhoDB < 0.45.0 - Path Traversalclidey · whodb · CVSS 10 · 2025-02-06 | 10.0 | 2.7% | 2025-02-06 |
| CVE-2025-27222CheckTRUfusion Enterprise <= 7.10.4.0 - Path TraversalRocketsoftware · Trufusion Enterprise · CVSS 8.6 · 2025-10-27 | 8.6 | 2.0% | 2025-10-27 |
| CVE-2020-27130Cisco Security Manager Path Traversal VulnerabilityCisco · Cisco Security Manager · CVSS 9.1 · 2020-11-17 | 9.1 | 66% | 2020-11-17 |
| CVE-2023-32714Path Traversal in Splunk App for Lookup File EditingSplunk · Splunk App for Lookup File Editing · CVSS 8.1 · 2023-06-01 | 8.1 | 43% | 2023-06-01 |
| CVE-2025-53417File Parsing Deserialization of Untrusted Data in DTM SoftDelta Electronics · DIAView · CVSS 9.3 · 2025-08-05 | 9.3 | 20% | 2025-08-05 |
| CVE-2018-3744The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.HackerOne · html-pages node module · 2018-05-29 | – | 2.2% | 2018-05-29 |
| CVE-2025-68428jsPDF has Local File Inclusion/Path Traversal vulnerabilityparallax · jsPDF · CVSS 8.6 · 2026-01-05 | 8.6 | 2.2% | 2026-01-05 |
| CVE-2023-46690Delta Electronics InfraSuite Device Master Path TraversalDelta Electronics · InfraSuite Device Master · CVSS 8.8 · 2023-11-30 | 8.8 | 1.9% | 2023-11-30 |
| CVE-2021-1132Cisco Network Services Orchestrator Path Traversal VulnerabilityCisco · Cisco Network Services Orchestrator · CVSS 5.3 · 2024-11-18 | 5.3 | 1.6% | 2024-11-18 |
| CVE-2022-24774Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository ServerCycloneDX · cyclonedx-bom-repo-server · CVSS 7.1 · 2022-03-22 | 7.1 | 1.5% | 2022-03-22 |
| CVE-2021-1357Cisco Unified Communications Products VulnerabilitiesCisco · Cisco Unified Communications Manager · CVSS 6.5 · 2021-01-20 | 6.5 | 1.4% | 2021-01-20 |
| CVE-2021-1355Cisco Unified Communications Products VulnerabilitiesCisco · Cisco Unified Communications Manager · CVSS 6.5 · 2021-01-20 | 6.5 | 1.4% | 2021-01-20 |
| CVE-2021-1364Cisco Unified Communications Products VulnerabilitiesCisco · Cisco Unified Communications Manager · CVSS 6.5 · 2021-01-20 | 6.5 | 1.4% | 2021-01-20 |
| CVE-2021-1282Cisco Unified Communications Products VulnerabilitiesCisco · Cisco Unified Communications Manager · CVSS 6.5 · 2021-01-20 | 6.5 | 1.4% | 2021-01-20 |
| CVE-2025-41723Sauter: Directory Traversal in importFile SOAP MethodSauter · modulo 6 devices modu680-AS · CVSS 9.8 · 2025-10-22 | 9.8 | 1.3% | 2025-10-22 |
| CVE-2024-39171Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statements to .htaccess and…Phpvibe · Phpvibe · CVSS 8.8 · 2024-07-09 | 8.8 | 1.2% | 2024-07-09 |
| CVE-2025-59793Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the applicat…Rocketsoftware · Trufusion Enterprise · CVSS 9.9 · 2026-02-17 | 9.9 | 1.2% | 2026-02-17 |
| CVE-2023-5885Franklin Electric Fueling Systems Colibri Path TraversalFranklin Electric Fueling Systems · Colibri · CVSS 6.5 · 2023-11-27 | 6.5 | 1.1% | 2023-11-27 |
| CVE-2024-0113NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A succe…NVIDIA · Mellanox OS · CVSS 7.5 · 2024-08-09 | 7.5 | 1.1% | 2024-08-09 |
| CVE-2025-26352A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive fil…Q-Free · MaxTime · CVSS 6.5 · 2025-02-12 | 6.5 | 1.1% | 2025-02-12 |
| CVE-2026-59115Microsoft Entra Provisioning Service Elevation of Privilege VulnerabilityMicrosoft · Microsoft Entra Provisioning Service · CVSS 9.9 · 2026-08-06 | 9.9 | 1.0% | 2026-08-06 |
| CVE-2025-64676Microsoft Purview eDiscovery Remote Code Execution VulnerabilityMicrosoft · Microsoft Purview · CVSS 7.2 · 2025-12-18 | 7.2 | 1.0% | 2025-12-18 |
| CVE-2024-21575ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint ad…ltdrdata · ComfyUI-Impact-Pack · CVSS 8.6 · 2024-12-12 | 8.6 | 1.0% | 2024-12-12 |
| CVE-2026-45495Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft · Microsoft Edge (Chromium-based) · CVSS 8.8 · 2026-05-18 | 8.8 | 1.0% | 2026-05-18 |
| CVE-2025-32585WordPress Shop Products Filter Plugin <= 1.2 - Local File Inclusion vulnerabilityTrusty Plugins · Shop Products Filter · CVSS 7.5 · 2025-04-11 | 7.5 | 1.0% | 2025-04-11 |
| CVE-2025-12972CVE-2025-12972FluentBit · Fluent Bit · CVSS 5.3 · 2025-11-24 | 5.3 | 0.9% | 2025-11-24 |
| CVE-2025-26355A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive f…Q-Free · MaxTime · CVSS 6.5 · 2025-02-12 | 6.5 | 0.9% | 2025-02-12 |
| CVE-2023-6252Path traversal vulnerability in Chameleon Power productsChameleon Power · Chameleon Power · CVSS 7.5 · 2023-11-22 | 7.5 | 0.9% | 2023-11-22 |
| CVE-2024-2654File Manager <= 7.2.5 - Authenticated (Administrator+) Directory Traversalmndpsingh287 · File Manager · CVSS 6.8 · 2024-04-09 | 6.8 | 0.9% | 2024-04-09 |
| CVE-2026-24464Appliance mode iControl REST vulnerabilityF5 · BIG-IP · CVSS 6.8 · 2026-05-13 | 6.8 | 0.9% | 2026-05-13 |
| CVE-2025-26353A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via cra…Q-Free · MaxTime · CVSS 4.9 · 2025-02-12 | 4.9 | 0.9% | 2025-02-12 |
| CVE-2025-26351A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files…Q-Free · MaxTime · CVSS 4.9 · 2025-02-12 | 4.9 | 0.9% | 2025-02-12 |
| CVE-2022-2265Path traversal in Identity and Directory Management SystemÇekino Bilgi Teknolojileri · Çekino Bilgi Teknolojileri · CVSS 7.5 · 2022-09-21 | 7.5 | 0.9% | 2022-09-21 |
| CVE-2025-59099Unauthenticated Path Traversal in dormakaba access managerdormakaba · Access Manager 92xx-k5 · CVSS 8.8 · 2026-01-26 | 8.8 | 0.9% | 2026-01-26 |
| CVE-2024-45190Mage AI pipeline interaction request remote arbitrary file leakMage · Mage-Ai · CVSS 6.5 · 2024-08-23 | 6.5 | 0.9% | 2024-08-23 |
| CVE-2025-26356A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker…Q-Free · MaxTime · CVSS 7.2 · 2025-02-12 | 7.2 | 0.8% | 2025-02-12 |
| CVE-2025-26354A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to ov…Q-Free · MaxTime · CVSS 7.2 · 2025-02-12 | 7.2 | 0.8% | 2025-02-12 |
| CVE-2026-45661Dokploy: Remote Code Execution through Path TraversalDokploy · dokploy · CVSS 9.9 · 2026-05-29 | 9.9 | 0.8% | 2026-05-29 |
| CVE-2025-30014Directory Traversal vulnerability in SAP Capital Yield Tax ManagementSAP_SE · SAP Capital Yield Tax Management · CVSS 7.7 · 2025-04-08 | 7.7 | 0.8% | 2025-04-08 |
| CVE-2026-13716Path Traversal: '.../...//' in Crafty ControllerArcadia Technology, LLC · Crafty Controller · CVSS 9.1 · 2026-08-11 | 9.1 | 0.8% | 2026-08-11 |
| CVE-2024-1886Absolute path traversal attack on LG SignageLG Electronics · LG Signage · CVSS 3 · 2024-02-26 | 3.0 | 0.8% | 2024-02-26 |
| CVE-2023-21418Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion. This fla…Axis Communications AB · AXIS OS · CVSS 7.1 · 2023-11-21 | 7.1 | 0.8% | 2023-11-21 |
| CVE-2024-47169Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversalagnaistic · agnai · CVSS 8.8 · 2024-09-26 | 8.8 | 0.8% | 2024-09-26 |
| CVE-2025-47176Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 7.8 · 2025-06-10 | 7.8 | 0.8% | 2025-06-10 |
| CVE-2025-41736Possible arbitrary code executionMETZ CONNECT · Energy-Controlling EWIO2-M · CVSS 8.8 · 2025-11-18 | 8.8 | 0.8% | 2025-11-18 |
| CVE-2024-10857Product Input Fields for WooCommerce <= 1.9 - Authenticated (Contributor+) Arbitrary File Readtychesoftwares · Product Input Fields for WooCommerce · CVSS 6.5 · 2024-11-26 | 6.5 | 0.8% | 2024-11-26 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.