| CWE-22 | Path Traversal | 10,485 | 85 | 549 |
| CWE-434 | Unrestricted File Upload | 4,345 | 26 | 115 |
| CWE-59 | Link Following | 1,688 | 22 | 1 |
| CWE-98 | PHP File Inclusion | 1,349 | 2 | 15 |
| CWE-427 | Uncontrolled Search Path | 1,201 | 3 | 0 |
| CWE-426 | Untrusted Search Path | 651 | 2 | 0 |
| CWE-73 | External Control of File Name or Path | 646 | 5 | 13 |
| CWE-23 | Relative Path Traversal | 548 | 6 | 16 |
| CWE-428 | Unquoted Search Path or Element | 449 | 0 | 0 |
| CWE-552 | Files or Directories Accessible to External Parties | 449 | 5 | 21 |
| CWE-35 | Path Traversal: '.../...//' | 201 | 1 | 5 |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | 189 | 1 | 0 |
| CWE-36 | Absolute Path Traversal | 146 | – | – |
| CWE-24 | Path Traversal: '../filedir' | 130 | – | – |
| CWE-377 | CWE-377 | 97 | – | – |
| CWE-29 | Path Traversal: '..filename' | 64 | – | – |
| CWE-379 | Creation of Temporary File in Directory with Insecure Permissions | 62 | – | – |
| CWE-41 | Improper Resolution of Path Equivalence | 44 | – | – |
| CWE-378 | Creation of Temporary File With Insecure Permissions | 43 | – | – |
| CWE-27 | Path Traversal: 'dir/../../filename' | 29 | – | – |
| CWE-114 | Process Control | 28 | – | – |
| CWE-26 | Path Traversal: '/dir/../filename' | 20 | – | – |
| CWE-1386 | Insecure Operation on Windows Junction / Mount Point | 20 | – | – |
| CWE-31 | Path Traversal: 'dir....filename' | 16 | – | – |
| CWE-641 | Improper Restriction of Names for Files and Other Resources | 15 | – | – |
| CWE-25 | Path Traversal: '/../filedir' | 12 | – | – |
| CWE-646 | Reliance on File Name or Extension of Externally-Supplied File | 11 | – | – |
| CWE-64 | Windows Shortcut Following (.LNK) | 9 | – | – |
| CWE-65 | Windows Hard Link | 7 | – | – |
| CWE-67 | Improper Handling of Windows Device Names | 7 | – | – |
| CWE-21 | Pathname Traversal and Equivalence Errors | 6 | – | – |
| CWE-37 | Path Traversal: '/absolute/pathname/here' | 6 | – | – |
| CWE-40 | Path Traversal: 'UNCsharename' (Windows UNC Share) | 6 | – | – |
| CWE-62 | UNIX Hard Link | 4 | – | – |
| CWE-28 | Path Traversal: '..filedir' | 3 | – | – |
| CWE-69 | Improper Handling of Windows ::DATA Alternate Data Stream | 3 | – | – |
| CWE-30 | Path Traversal: 'dir..filename' | 2 | – | – |
| CWE-32 | Path Traversal: '...' (Triple Dot) | 2 | – | – |
| CWE-50 | Path Equivalence: '//multiple/leading/slash' | 2 | – | – |
| CWE-34 | Path Traversal: '....//' | 1 | – | – |
| CWE-38 | Path Traversal: 'absolutepathnamehere' | 1 | – | – |
| CWE-39 | Path Traversal: 'C:dirname' | 1 | – | – |
| CWE-42 | Path Equivalence: 'filename.' (Trailing Dot) | 1 | – | – |
| CWE-43 | Path Equivalence: 'filename....' (Multiple Trailing Dot) | 1 | – | – |
| CWE-44 | Path Equivalence: 'file.name' (Internal Dot) | 1 | – | – |
| CWE-46 | Path Equivalence: 'filename ' (Trailing Space) | 1 | – | – |
| CWE-55 | Path Equivalence: '/./' (Single Dot Directory) | 1 | – | – |
| CWE-57 | Path Equivalence: 'fakedir/../realdir/filename' | 1 | – | – |
| CWE-66 | Improper Handling of File Names that Identify Virtual Resources | 1 | – | – |
| CWE-553 | Command Shell in Externally Accessible Directory | 1 | – | – |