CWE-25— Path Traversal: '/../filedir'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.— MITRE CWE catalog
12 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-25page 1 of 1
- CVE-2022-20775HIGHCVSS 7.8EG 9.0⚠ KEV2022-09-30
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker coul…
- CVE-2022-20818HIGHCVSS 7.8EG 7.82022-09-30
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An att…
- CVE-2023-52076HIGHCVSS 8.5EG 8.52024-01-25
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing a…
- CVE-2023-52138HIGHCVSS 8.2EG 8.22024-02-05
Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives,…
- CVE-2023-6118HIGHCVSS 7.5EG 7.52023-11-23
Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP Camera: before b1130.1.0.1.
- CVE-2023-6919HIGHCVSS 7.5EG 7.52024-01-26
Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal. This issue affects VGuard: before V500.0003.R008.4011.C0012.B351.C.
- CVE-2023-6947HIGHCVSS 7.7EG 7.72024-12-10
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher t…
- CVE-2024-2442HIGHCVSS 7.5EG 7.52024-03-19
Franklin Fueling System EVO 550 and EVO 5000 are vulnerable to a Path Traversal vulnerability that could allow an attacker to access sensitive files on the system.
- CVE-2025-0225MEDIUMCVSS 4.3EG 4.32025-01-05
A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipu…
- CVE-2025-58286LOWCVSS 3.3EG 3.32025-10-11
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- CVE-2025-68916CRITICALCVSS 9.1EG 9.12025-12-24
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution.
- CVE-2026-23877MEDIUMCVSS 4.3EG 4.32026-01-19
Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (in…
Map vulnerabilities like CWE-25 to your infrastructure
EchelonGraph correlates every CVE — across CWE-25 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →