CWE-22— Path Traversal

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.— MITRE CWE catalog

8,729 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-22page 37 of 175

CVE-2015-3309HIGHCVSS 7.5EG 7.5
2020-02-13
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API…
CVE-2015-4068CRITICALCVSS 9.1EG 9.1⚠ KEV
2015-05-29
Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.
CVE-2015-4461MEDIUMCVSS 6.5EG 6.5
2018-02-05
Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.
CVE-2015-4617HIGHCVSS 7.5EG 7.5
2019-02-15
Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.
CVE-2015-4632HIGHCVSS 7.5EG 7.5
2018-10-18
Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the te…
CVE-2015-5079HIGHCVSS 7.5EG 7.5
2018-02-28
Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the dl parameter.
CVE-2015-5467CRITICALCVSS 9.8EG 9.8
2023-09-21
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
CVE-2015-5952CRITICALCVSS 9.8EG 9.8
2020-01-15
Directory traversal vulnerability in Thomson Reuters for FATCA before 5.2 allows remote attackers to execute arbitrary files via the item parameter.
CVE-2015-6589HIGHCVSS 8.8EG 8.8
2020-02-13
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute…
CVE-2015-6591MEDIUMCVSS 5.5EG 5.5
2020-01-15
Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and earlier allows local users to read arbitrary files via the s parameter.
CVE-2015-7851MEDIUMCVSS 6.5EG 6.5
2020-01-28
Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated …
CVE-2015-8535HIGHCVSS 7.8EG 7.8
2020-03-27
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that cou…
CVE-2015-9250HIGHCVSS 7.5EG 7.5
2018-01-12
An issue was discovered in Skybox Platform before 7.5.201. Directory Traversal exists in /skyboxview/webskybox/attachmentdownload and /skyboxview/webskybox/filedownload via the tempFileName parameter.
CVE-2015-9266CRITICALCVSS 9.8EG 9.8
2018-09-05
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exp…
CVE-2015-9275MEDIUMCVSS 5.3EG 5.3
2019-01-07
ARC 5.21q allows directory traversal via a full pathname in an archive file.
CVE-2015-9277CRITICALCVSS 9.1EG 9.1
2019-01-16
MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.
CVE-2015-9287CRITICALCVSS 9.8EG 9.8
2019-05-13
Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not…
CVE-2015-9406HIGHCVSS 7.5EG 9.0
2019-09-20
Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.
CVE-2015-9463HIGHCVSS 7.5EG 7.5
2019-10-10
The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.
CVE-2015-9464HIGHCVSS 7.5EG 7.5
2019-10-10
The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.
CVE-2015-9470HIGHCVSS 7.5EG 7.5
2019-10-10
The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter.
CVE-2015-9473HIGHCVSS 7.5EG 7.5
2019-10-10
The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.
CVE-2015-9480HIGHCVSS 7.5EG 7.5
2019-10-10
The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.
CVE-2015-9538MEDIUMCVSS 6.5EG 6.5
2019-11-26
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.
CVE-2015-9546MEDIUMCVSS 4.8EG 4.8
2020-04-10
An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-06-16. In some cases, HTTP is used for an Inputmethod, rather than HTTPS. A man-in-the-middle attacker can modify the client-server data stream …
CVE-2016-10528MEDIUMCVSS 4.9EG 4.9
2018-05-31
restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it speci…
CVE-2016-10538LOWCVSS 3.5EG 3.5
2018-05-31
The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
CVE-2016-10561MEDIUMCVSS 5.3EG 5.3
2018-05-31
Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is exploitable via the URL path in GET requests.
CVE-2016-10726HIGHCVSS 7.5EG 7.5
2018-07-10
The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Refere…
CVE-2016-10733CRITICALCVSS 9.8EG 9.8
2018-10-29
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
CVE-2016-10751HIGHCVSS 7.2EG 7.2
2019-05-24
osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?pa…
CVE-2016-10759CRITICALCVSS 9.8EG 9.8
2019-05-24
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks …
CVE-2016-10828HIGHCVSS 8.8EG 8.8
2019-08-01
cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
CVE-2016-10924HIGHCVSS 7.5EG 7.5
2019-08-22
The ebook-download plugin before 1.2 for WordPress has directory traversal.
CVE-2016-10965HIGHCVSS 7.5EG 7.5
2019-09-16
The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.
CVE-2016-10966HIGHCVSS 7.5EG 7.5
2019-09-16
The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.
CVE-2016-10977MEDIUMCVSS 6.5EG 6.5
2019-09-17
The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
CVE-2016-15017MEDIUMCVSS 5.5EG 9.8
2023-01-10
A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname t…
CVE-2016-15019MEDIUMCVSS 4.3EG 7.5
2023-01-15
A vulnerability was found in tombh jekbox. It has been rated as problematic. This issue affects some unknown processing of the file lib/server.rb. The manipulation leads to exposure of information through directory listing. The attack may …
CVE-2016-15023LOWCVSS 3.5EG 5.3
2023-01-31
A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getextension.php of the component Extension Handler. The manipulation leads to path trav…
CVE-2016-15038MEDIUMCVSS 6.5EG 6.5
2024-04-01
A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The manipulation of the argument filename leads to path traversal. It is possible to l…
CVE-2016-15055HIGHCVSS 8.7EG 8.7
2025-11-12
JVC VN-T IP-camera models firmware versions up to 2016-08-22 (confirmed on the VN-T216VPRU model) contain a directory traversal vulnerability in the checkcgi endpoint that accepts a user-controlled file parameter. An unauthenticated remote…
CVE-2016-20023MEDIUMCVSS 5.0EG 5.0
2025-12-05
In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.
CVE-2016-20040HIGHCVSS 8.4EG 8.4
2026-03-28
TiEmu 3.03-nogdb+dfsg-3 contains a buffer overflow vulnerability in the ROM parameter handling that allows local attackers to crash the application or execute arbitrary code. Attackers can supply an oversized ROM parameter to the tiemu com…
CVE-2016-20041HIGHCVSS 8.4EG 8.4
2026-03-28
Yasr 0.6.9-5 contains a buffer overflow vulnerability that allows local attackers to crash the application or execute arbitrary code by supplying an oversized argument to the -p parameter. Attackers can invoke yasr with a crafted payload c…
CVE-2016-20048HIGHCVSS 8.4EG 8.4
2026-03-28
iSelect 1.4.0-2+b1 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized value to the -k/--key parameter. Attackers can craft a malicious argument containing a NOP sl…
CVE-2016-20076HIGHCVSS 7.5EG 7.5
2026-06-15
WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tool…
CVE-2016-20081HIGHCVSS 7.5EG 7.5
2026-06-15
WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-downlo…
CVE-2016-3976HIGHCVSS 7.5EG 9.0⚠ KEV
2016-04-07
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
CVE-2016-7041MEDIUMCVSS 6.5EG 6.5
2018-09-10
Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host.

Map vulnerabilities like CWE-22 to your infrastructure

EchelonGraph correlates every CVE — across CWE-22 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →