Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (10,830)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2009-1523 1Mortbay 1Jetty Apr 23, 2026 May 5, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
CVE-2009-1519 1Pecio Cms 1Pecio Cms Apr 23, 2026 May 4, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in index.php in Pecio CMS 1.1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.
CVE-2009-1510 1Koschtit 1Koschtit Image Gallery Apr 23, 2026 May 1, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the file parameter to (1) ki_makepic.ph...Show more Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the file parameter to (1) ki_makepic.php and (2) ki_nojsdisplayimage.php in ki_base/.Show less
CVE-2008-6786 1Codewiz 1Geekigeeki Apr 23, 2026 May 1, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Multiple directory traversal vulnerabilities in geekigeeki.py in GeekiGeeki before 3.0 allow remote attackers to read arbitrary files via directory traversal sequences in a pagename argument in the (1) handle_edit and (2...Show more Multiple directory traversal vulnerabilities in geekigeeki.py in GeekiGeeki before 3.0 allow remote attackers to read arbitrary files via directory traversal sequences in a pagename argument in the (1) handle_edit and (2) handle_raw functions.Show less
CVE-2009-1502 1.matteoiammarrone 1S Cms Apr 23, 2026 May 1, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
CVE-2009-1498 1Idb 1Idb Apr 23, 2026 May 1, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) i...Show more Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter in a settings action to profile.php.Show less
CVE-2009-1496 1Ijobid 1Com Cmimarketplace Apr 23, 2026 May 1, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php.
CVE-2009-1488 1Rens Rikkerink 1Fungamez Apr 23, 2026 Apr 29, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter to index.php.
CVE-2009-1486 1Ninjadesigns 1Flatchat Apr 23, 2026 Apr 29, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the with parameter.
CVE-2009-1456 1Stephane Rajalu 1Malleo Apr 23, 2026 Apr 28, 2009 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Directory traversal vulnerability in admin.php in Malleo 1.2.3 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the module parameter.
CVE-2009-1445 1Ivano Culmine 1Webportal Cms Apr 23, 2026 Apr 27, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple directory traversal vulnerabilities in WebPortal CMS 0.8-beta allow remote attackers to (1) read arbitrary files via directory traversal sequences in the lang parameter to libraries/helpdocs/help.php and (2) inc...Show more Multiple directory traversal vulnerabilities in WebPortal CMS 0.8-beta allow remote attackers to (1) read arbitrary files via directory traversal sequences in the lang parameter to libraries/helpdocs/help.php and (2) include and execute arbitrary local files via directory traversal sequences in the error parameter to index.php.Show less
CVE-2009-1407 1Wonko 1Notftp Apr 23, 2026 Apr 24, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a certain languages[][file] parameter.
CVE-2009-1406 1Sweetphp 1Totalcalendar Apr 23, 2026 Apr 24, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in cms_detect.php in TotalCalendar 2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the include parameter.
CVE-2009-1405 1Pastel 1Pastelcms Apr 23, 2026 Apr 24, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in index.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the set_lng parameter.
CVE-2009-1368 1Mozilo 1Mozilocms Apr 23, 2026 Apr 22, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter. NOTE: this might be the same issue as CVE-2008-6126.2, which may...Show more Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter. NOTE: this might be the same issue as CVE-2008-6126.2, which may have been fixed in 1.10.3.Show less
CVE-2008-6735 1Thaiquickcart 1Thaiquickcart Apr 23, 2026 Apr 21, 2009 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Directory traversal vulnerability in qc/index.php in ThaiQuickCart 3 allows remote attackers to read arbitrary files via a .. (dot dot) in the sLanguage cookie.
CVE-2008-6734 1Keller Web Admin 1Kwa Apr 23, 2026 Apr 21, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 Directory traversal vulnerability in Public/index.php in Keller Web Admin CMS 0.94 Pro allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter.
CVE-2009-1354 1Sergey Lyubka 1Mongoose Apr 23, 2026 Apr 21, 2009 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVE-2008-5518 1Apache 1Geronimo Apr 23, 2026 Apr 17, 2009 N/A· v4 N/A· v3 9.4 HIGH· v2 Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via direct...Show more Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.Show less
CVE-2009-1319 1Guestcal 1Guest Cal Apr 23, 2026 Apr 17, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the lang parameter to index.php.

Previous 1...504505506...542 Next