CWE-73 · File and Path Handling
External Control of File Name or Path
646CVEs
5exploited
13with a public check
15likely (EPSS 10%+)
SortMost likely exploited
646 CVEs with CWE-73 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-33053In CISA KEVExploitedInternet Shortcut Files Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 8.8 · 2025-06-10 | 8.8 | 87% | 2025-06-10 |
| CVE-2024-43451In CISA KEVExploitedNTLM Hash Disclosure Spoofing VulnerabilityMicrosoft · Windows Server 2025 · CVSS 6.5 · 2024-11-12 | 6.5 | 84% | 2024-11-12 |
| CVE-2025-24054In CISA KEVExploitedNTLM Hash Disclosure Spoofing VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 6.5 · 2025-03-11 | 6.5 | 62% | 2025-03-11 |
| CVE-2026-96656In CISA KEVExploitedPlex Media Server < 1.43.3.10861 - Arbitrary File Write to Code ExecutionPlex · Media Server · CVSS 7.2 · 2026-09-23 | 7.2 | 20% | 2026-09-23 |
| CVE-2025-0111In CISA KEVExploitedPAN-OS: Authenticated File Read Vulnerability in the Management Web InterfacePalo Alto Networks · Cloud NGFW · CVSS 7.1 · 2025-02-12 | 7.1 | 2.0% | 2025-02-12 |
| CVE-2022-39952CheckFortinet FortiNAC - Arbitrary File WriteFortinet · FortiNAC · CVSS 9.8 · 2023-02-16 | 9.8 | 100% | 2023-02-16 |
| CVE-2024-8517CheckSPIP BigUp Plugin - Remote Code ExecutionSPIP · SPIP · CVSS 9.8 · 2024-09-06 | 9.8 | 95% | 2024-09-06 |
| CVE-2023-4634CheckMedia Library Assistant < 3.09 - Remote Code Execution/Local File Inclusiondglingren · Media Library Assistant · CVSS 9.8 · 2023-09-06 | 9.8 | 86% | 2023-09-06 |
| CVE-2018-17246CheckKibana - Local File InclusionElastic · Kibana · 2018-12-20 | – | 84% | 2018-12-20 |
| CVE-2023-3643CheckCAREL Boss Mini <= 1.4.0 - Local File InclusionCarel · Boss Mini · CVSS 7.3 · 2023-07-12 | 7.3 | 75% | 2023-07-12 |
| CVE-2022-24900CheckPiano LED Visualizer 1.3 - Local File Inclusiononlaj · Piano-LED-Visualizer · CVSS 9.9 · 2022-04-29 | 9.9 | 8.4% | 2022-04-29 |
| CVE-2023-30943CheckMoodle - Cross-Site Scripting/Remote Code ExecutionMoodle · Moodle · CVSS 6.5 · 2023-05-02 | 6.5 | 6.8% | 2023-05-02 |
| CVE-2025-71334CheckFlowise - Path TraversalFlowise · Flowise · CVSS 9.8 · 2026-06-25 | 9.8 | 4.4% | 2026-06-25 |
| CVE-2024-5334CheckDevika - Local File Inclusionstitionai · stitionai/devika · CVSS 7.5 · 2024-06-27 | 7.5 | 2.1% | 2024-06-27 |
| CVE-2025-59049CheckMockoon < 9.2.0 - Path Traversalmockoon · mockoon · CVSS 7.5 · 2025-09-10 | 7.5 | 1.8% | 2025-09-10 |
| CVE-2025-71324CheckFlowise - Path TraversalFlowise · Flowise · CVSS 7.5 · 2026-06-25 | 7.5 | 1.6% | 2026-06-25 |
| CVE-2026-29962CheckHSC MailInspector - Local File InclusionHsclabs · Mailinspector · CVSS 7.5 · 2026-05-18 | 7.5 | 1.5% | 2026-05-18 |
| CVE-2025-55746CheckDirectus - Unauthenticated File Modificationdirectus · directus · CVSS 9.3 · 2025-08-20 | 9.3 | 1.5% | 2025-08-20 |
| CVE-2021-27250This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication…D-Link · DAP-2020 · CVSS 6.5 · 2021-04-14 | 6.5 | 67% | 2021-04-14 |
| CVE-2021-21343XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rightsx-stream · xstream · CVSS 5.3 · 2021-03-22 | 5.3 | 47% | 2021-03-22 |
| CVE-2025-21377NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 6.5 · 2025-02-11 | 6.5 | 40% | 2025-02-11 |
| CVE-2024-26185Windows Compressed Folder Tampering VulnerabilityMicrosoft · Windows 11 version 22H2 · CVSS 6.5 · 2024-03-12 | 6.5 | 30% | 2024-03-12 |
| CVE-2023-2554External Control of File Name or Path in unilogies/bumsysunilogies · unilogies/bumsys · CVSS 7.2 · 2023-05-05 | 7.2 | 29% | 2023-05-05 |
| CVE-2024-37149GLPI allows remote code execution through the plugin loaderglpi-project · glpi · CVSS 7.2 · 2024-07-10 | 7.2 | 21% | 2024-07-10 |
| CVE-2024-0265SourceCodester Clinic Queuing System GET Parameter index.php file inclusionSourceCodester · Clinic Queuing System · CVSS 6.3 · 2024-01-07 | 6.3 | 21% | 2024-01-07 |
| CVE-2024-0087CVEnvidia · NVIDIA Triton Inference Server · CVSS 9 · 2024-05-09 | 9.0 | 20% | 2024-05-09 |
| CVE-2026-20872NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 6.5 · 2026-01-13 | 6.5 | 20% | 2026-01-13 |
| CVE-2026-20925NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 6.5 · 2026-01-13 | 6.5 | 18% | 2026-01-13 |
| CVE-2023-36019Microsoft Power Platform Connector Spoofing VulnerabilityMicrosoft · Microsoft Power Platform · CVSS 9.6 · 2023-12-12 | 9.6 | 16% | 2023-12-12 |
| CVE-2025-6463Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletionwpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 8.8 · 2025-07-02 | 8.8 | 15% | 2025-07-02 |
| CVE-2026-44127Local File Inclusion (LFI) and Arbitrary File DeletionSEPPmail AG · Secure Email Gateway · CVSS 8.8 · 2026-05-08 | 8.8 | 15% | 2026-05-08 |
| CVE-2025-0105Expedition: Arbitrary File Deletion VulnerabilityPalo Alto Networks · Cloud NGFW · CVSS 6.9 · 2025-01-11 | 6.9 | 13% | 2025-01-11 |
| CVE-2026-21249Windows NTLM Spoofing VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 3.3 · 2026-02-10 | 3.3 | 11% | 2026-02-10 |
| CVE-2025-68478Langflow Vulnerable to External Control of File Name or Pathlangflow-ai · langflow · CVSS 7.1 · 2025-12-19 | 7.1 | 5.8% | 2025-12-19 |
| CVE-2021-24966Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File ClearingBestwebsoft · Error Log Viewer by BestWebSoft · 2022-03-14 | – | 5.2% | 2022-03-14 |
| CVE-2022-2431Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletiondownload-manager · Download Manager · CVSS 8.1 · 2022-09-06 | 8.1 | 3.9% | 2022-09-06 |
| CVE-2023-39542A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files, which can lead to r…Foxit · Foxit Reader · CVSS 8.8 · 2023-11-27 | 8.8 | 3.8% | 2023-11-27 |
| CVE-2022-0246iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip SlipWebence · iQ Block Country · 2022-04-11 | – | 3.4% | 2022-04-11 |
| CVE-2022-32761An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request…WWBN · AVideo · CVSS 6.5 · 2022-08-22 | 6.5 | 2.9% | 2022-08-22 |
| CVE-2023-29324Windows MSHTML Platform Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 6.5 · 2023-05-09 | 6.5 | 2.8% | 2023-05-09 |
| CVE-2022-28710An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbi…WWBN · AVideo · CVSS 6.5 · 2022-08-22 | 6.5 | 2.8% | 2022-08-22 |
| CVE-2020-2008PAN-OS: OS command injection or arbitrary file deletion vulnerabilityPalo Alto Networks · PAN-OS · CVSS 7.2 · 2020-05-13 | 7.2 | 2.8% | 2020-05-13 |
| CVE-2023-35985An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A…Foxit · Foxit Reader · CVSS 8.8 · 2023-11-27 | 8.8 | 2.7% | 2023-11-27 |
| CVE-2014-2375Ecava IntegraXor SCADA Server External Control of File Name or PathEcava · IntegraXor SCADA Server · CVSS 8.3 · 2014-09-15 | 8.3 | 2.3% | 2014-09-15 |
| CVE-2018-14820Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion w…Advantech · Advantech WebAccess · 2018-10-23 | – | 2.2% | 2018-10-23 |
| CVE-2026-92193Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure VulnerabilityQuest · Foglight for Databases · CVSS 6.5 · 2026-11-03 | 6.5 | 2.1% | 2026-11-03 |
| CVE-2023-46851Apache Allura: sensitive information exposure via importApache Software Foundation · Apache Allura · 2023-11-07 | – | 2.1% | 2023-11-07 |
| CVE-2018-7495In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior…Advantech · WebAccess · 2018-05-15 | – | 2.1% | 2018-05-15 |
| CVE-2023-36764Microsoft SharePoint Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.8 · 2023-09-12 | 8.8 | 2.1% | 2023-09-12 |
| CVE-2020-6105An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information ov…F2fs-Tools Project · F2fs-Tools · CVSS 8.2 · 2020-10-15 | 8.2 | 2.1% | 2020-10-15 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.