CWE-36 · File and Path Handling
Absolute Path Traversal
146CVEs
SortMost likely exploited
146 CVEs with CWE-36 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-13159In CISA KEVExploitedIvanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursiveIvanti · Endpoint Manager · CVSS 9.8 · 2025-01-14 | 9.8 | 100% | 2025-01-14 |
| CVE-2018-20250In CISA KEVExploitedIn WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field…Check Point Software Technologies Ltd. · WinRAR · CVSS 7.8 · 2019-02-05 | 7.8 | 96% | 2019-02-05 |
| CVE-2024-48248In CISA KEVExploitedNAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File ReadNAKIVO · Backup & Replication Director · CVSS 8.6 · 2025-03-04 | 8.6 | 94% | 2025-03-04 |
| CVE-2024-13160In CISA KEVExploitedIvanti EPM - Credential Coercion Vulnerability in GetHashForWildcardIvanti · Endpoint Manager · CVSS 9.8 · 2025-01-14 | 9.8 | 91% | 2025-01-14 |
| CVE-2024-13161In CISA KEVExploitedIvanti EPM - Credential Coercion Vulnerability in GetHashForSingleFileIvanti · Endpoint Manager · CVSS 9.8 · 2025-01-14 | 9.8 | 90% | 2025-01-14 |
| CVE-2023-3765CheckMLflow Absolute Path Traversalmlflow · mlflow/mlflow · CVSS 10 · 2023-07-19 | 10.0 | 67% | 2023-07-19 |
| CVE-2025-46822CheckJava-springboot-codebase 1.1 - Arbitrary File ReadOsamaTaher · Java-springboot-codebase · CVSS 7.7 · 2025-05-21 | 7.7 | 4.1% | 2025-05-21 |
| CVE-2026-28414CheckGradio - Absolute Path Traversalgradio-app · gradio · CVSS 7.5 · 2026-02-27 | 7.5 | 3.1% | 2026-02-27 |
| CVE-2024-6250CheckLOLLMS WebUI - Absolute Path Traversalparisneo · parisneo/lollms-webui · CVSS 7.5 · 2024-06-27 | 7.5 | 1.9% | 2024-06-27 |
| CVE-2025-57790Path Traversal VulnerabilityCommvault · CommCell · CVSS 8.7 · 2025-08-20 | 8.7 | 44% | 2025-08-20 |
| CVE-2025-0851Path traversal issue in Deep Java LibraryAWS · DeepJavaLibrary · CVSS 9.8 · 2025-01-29 | 9.8 | 26% | 2025-01-29 |
| CVE-2025-34392Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCEBarracuda Networks · RMM · CVSS 10 · 2025-12-10 | 10.0 | 26% | 2025-12-10 |
| CVE-2021-21586Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A remote authenticated malicious user could exploit this vulnerability in order to…Dell · Wyse Management Suite · CVSS 8.1 · 2021-07-15 | 8.1 | 4.0% | 2021-07-15 |
| CVE-2021-1297Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Arbitrary File Write VulnerabilitiesCisco · Cisco Small Business RV Series Router Firmware · CVSS 7.5 · 2021-02-04 | 7.5 | 3.7% | 2021-02-04 |
| CVE-2021-1296Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Arbitrary File Write VulnerabilitiesCisco · Cisco Small Business RV Series Router Firmware · CVSS 7.5 · 2021-02-04 | 7.5 | 3.7% | 2021-02-04 |
| CVE-2024-10811Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensi…Ivanti · Endpoint Manager · CVSS 9.8 · 2025-01-14 | 9.8 | 3.5% | 2025-01-14 |
| CVE-2024-29053Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft · Microsoft Defender for IoT · CVSS 8.8 · 2024-04-09 | 8.8 | 3.2% | 2024-04-09 |
| CVE-2024-21323Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft · Microsoft Defender for IoT · CVSS 8.8 · 2024-04-09 | 8.8 | 3.2% | 2024-04-09 |
| CVE-2021-1618Cisco Intersight Virtual Appliance VulnerabilitiesCisco · Cisco Intersight Virtual Appliance · CVSS 6.5 · 2021-07-22 | 6.5 | 2.7% | 2021-07-22 |
| CVE-2023-36786Skype for Business Remote Code Execution VulnerabilityMicrosoft · Skype for Business Server 2015 CU13 · CVSS 7.2 · 2023-10-10 | 7.2 | 2.6% | 2023-10-10 |
| CVE-2024-20401A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files o…Cisco · Cisco Secure Email · CVSS 9.8 · 2024-07-17 | 9.8 | 2.3% | 2024-07-17 |
| CVE-2023-2765Weaver OA downfile.php absolute path traversalWeaver · OA · CVSS 4.3 · 2023-05-17 | 4.3 | 2.2% | 2023-05-17 |
| CVE-2025-53392In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's per…Netgate · pfSense · CVSS 5 · 2025-06-28 | 5.0 | 1.9% | 2025-06-28 |
| CVE-2024-47883Butterfly has path/URL confusion in resource handling leading to multiple weaknessesOpenRefine · simile-butterfly · CVSS 9.1 · 2024-10-24 | 9.1 | 1.6% | 2024-10-24 |
| CVE-2023-34135Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via web service. This is…SonicWall · GMS · 2023-07-13 | – | 1.6% | 2023-07-13 |
| CVE-2017-7929An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an att…Advantech · Advantech WebAccess · 2017-05-06 | – | 1.5% | 2017-05-06 |
| CVE-2021-1617Cisco Intersight Virtual Appliance VulnerabilitiesCisco · Cisco Intersight Virtual Appliance · CVSS 6.5 · 2021-07-22 | 6.5 | 1.5% | 2021-07-22 |
| CVE-2022-20791Cisco Unified Communications Products Arbitrary File Read VulnerabilityCisco · Cisco Unified Communications Manager · CVSS 6.5 · 2022-07-06 | 6.5 | 1.5% | 2022-07-06 |
| CVE-2022-1554Path Traversal due to `send_file` call in clinical-genomics/scoutclinical-genomics · clinical-genomics/scout · CVSS 6.8 · 2022-05-03 | 6.8 | 1.4% | 2022-05-03 |
| CVE-2023-33871Iagona ScrutisWeb Absolute Path Traversaliagona · ScrutisWeb · CVSS 7.5 · 2023-07-18 | 7.5 | 1.3% | 2023-07-18 |
| CVE-2021-32507QSAN Storage Manager - Absolute Path Traversal via FileDownload functionQSAN · Storage Manager · CVSS 6.5 · 2021-07-07 | 6.5 | 1.3% | 2021-07-07 |
| CVE-2021-32506QSAN Storage Manager - Absolute Path Traversal via GetImage functionQSAN · Storage Manager · CVSS 6.5 · 2021-07-07 | 6.5 | 1.3% | 2021-07-07 |
| CVE-2026-83683Windows Encrypting File System (EFS) Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 6.5 · 2026-10-13 | 6.5 | 1.3% | 2026-10-13 |
| CVE-2021-30173Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File InclusionJun-He Technology Ltd. · Quan-Fang-Wei-Tong-Xun system · CVSS 6.5 · 2021-05-07 | 6.5 | 1.2% | 2021-05-07 |
| CVE-2022-24877Improper path handling in kustomization files allows path traversalfluxcd · flux2 · CVSS 9.9 · 2022-05-06 | 9.9 | 1.2% | 2022-05-06 |
| CVE-2026-70297Skype for Business Remote Code Execution VulnerabilityMicrosoft · Skype for Business Server 2015 CU13 · CVSS 8.8 · 2026-10-13 | 8.8 | 1.2% | 2026-10-13 |
| CVE-2024-2362Path Traversal in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 9.1 · 2024-06-06 | 9.1 | 1.1% | 2024-06-06 |
| CVE-2022-20958A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a server-side request fo…Cisco · Cisco BroadWorks · CVSS 8.3 · 2022-11-03 | 8.3 | 1.1% | 2022-11-03 |
| CVE-2026-83746Skype for Business Elevation of Privilege VulnerabilityMicrosoft · Skype for Business Server 2015 CU13 · CVSS 8.1 · 2026-10-13 | 8.1 | 1.1% | 2026-10-13 |
| CVE-2026-83784Windows Encrypting File System (EFS) Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 8.8 · 2026-10-13 | 8.8 | 1.1% | 2026-10-13 |
| CVE-2024-10047Directory Listing Vulnerability in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 5.3 · 2025-03-20 | 5.3 | 1.0% | 2025-03-20 |
| CVE-2024-8501Arbitrary File Download in modelscope/agentscopemodelscope · modelscope/agentscope · CVSS 7.5 · 2025-03-20 | 7.5 | 1.0% | 2025-03-20 |
| CVE-2025-4799WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletiongamerz · WP-DownloadManager · CVSS 7.2 · 2025-06-11 | 7.2 | 1.0% | 2025-06-11 |
| CVE-2023-5115Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesRed Hat · Red Hat Ansible Automation Platform 2.3 for RHEL 8 · CVSS 6.3 · 2023-12-18 | 6.3 | 1.0% | 2023-12-18 |
| CVE-2026-89009WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_serverWAVLINK Technology · WN535M1 · CVSS 9.1 · 2026-09-11 | 9.1 | 1.0% | 2026-09-11 |
| CVE-2025-9518atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletiondocjojo · atec Debug · CVSS 7.2 · 2025-09-04 | 7.2 | 0.9% | 2025-09-04 |
| CVE-2023-4172Chengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx absolute path traversalChengdu · Flash Flood Disaster Monitoring and Warning System · CVSS 4.3 · 2023-08-05 | 4.3 | 0.9% | 2023-08-05 |
| CVE-2023-32054Volume Shadow Copy Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.3 · 2023-07-11 | 7.3 | 0.9% | 2023-07-11 |
| CVE-2024-4881Path Traversal in parisneo/lollmsparisneo · parisneo/lollms · CVSS 7.5 · 2024-06-06 | 7.5 | 0.9% | 2024-06-06 |
| CVE-2024-2548Path Traversal in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 7.5 · 2024-06-06 | 7.5 | 0.9% | 2024-06-06 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.