Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (10,830)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-6505 1Apache 1Struts Apr 23, 2026 Mar 23, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path,...Show more Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.Show less
CVE-2008-6502 1Prochatrooms 1Pro Chat Rooms Apr 23, 2026 Mar 20, 2009 N/A· v4 N/A· v3 4.6 MEDIUM· v2 Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an avatar via a .. (dot dot) in the avatar parameter, and cause other users to execut...Show more Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an avatar via a .. (dot dot) in the avatar parameter, and cause other users to execute this script by using sendData.php to send a message to (1) an individual user or (2) a room, leading to cross-site request forgery (CSRF), cross-site scripting (XSS), or other impacts.Show less
CVE-2009-1031 1Solarwinds 1Serv U File Server Apr 23, 2026 Mar 20, 2009 N/A· v4 N/A· v3 7.8 HIGH· v2 Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows remote attackers to create arbitrary directories via a \.. (backslash dot dot) in an MKD request.
CVE-2009-0932 1Debian 2Horde Horde Groupware Apr 23, 2026 Mar 17, 2009 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal...Show more Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.Show less
CVE-2009-0929 1Nucleus Group 1Nucleus Cms Apr 23, 2026 Mar 17, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in the media manager in Nucleus CMS before 3.40 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2008-6453 16rbscript 16rbscript Apr 23, 2026 Mar 13, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Directory traversal vulnerability in section.php in 6rbScript 3.3, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the name parameter.
CVE-2009-0886 1Oneorzero 1Oneorzero Helpdesk Apr 23, 2026 Mar 12, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter.
CVE-2009-0880 1Ibm 1Director Apr 23, 2026 Mar 12, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. (dot dot) in a /CIMListener/ URI...Show more Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. (dot dot) in a /CIMListener/ URI in an M-POST request.Show less
CVE-2009-0865 1Geovision 1Livex Activex Control Apr 23, 2026 Mar 10, 2009 N/A· v4 N/A· v3 8.8 HIGH· v2 Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OCX allows remote attackers to create or overwrite arbitrary files via a...Show more Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OCX allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument, possibly involving the PlayX and SnapShotX methods.Show less
CVE-2008-6424 1Jun Sota 1Ffftp Apr 23, 2026 Mar 6, 2009 N/A· v4 N/A· v3 8.8 HIGH· v2 Directory traversal vulnerability in FFFTP 1.96b allows remote FTP servers to create or overwrite arbitrary files via a response to an FTP LIST command with a filename that contains a .. (dot dot).
CVE-2008-6423 1I Apps 1Passwiki Apr 23, 2026 Mar 6, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in passwiki.php in PassWiki 0.9.16 RC3 and earlier allows remote attackers to read arbitrary local files via a .. (dot dot) in the site_id parameter.
CVE-2008-6410 1Brian Wilson 1Ol'bookmarks Apr 23, 2026 Mar 6, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in show.php in ol'bookmarks manager 0.7.5 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the show parameter.
CVE-2008-6407 1Brian Wilson 1Ol'bookmarks Apr 23, 2026 Mar 6, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in frame.php in ol'bookmarks manager 0.7.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the framefile parameter.
CVE-2009-0766 1Bookelves 1Kipper Apr 23, 2026 Mar 6, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in default.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the configfile parameter. NOTE: the provenance of...Show more Directory traversal vulnerability in default.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the configfile parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2009-0765 1Bookelves 1Kipper Apr 23, 2026 Mar 6, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the configfile parameter.
CVE-2009-0753 1Mldonkey 1Mldonkey Apr 23, 2026 Mar 3, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files via a leading "//" (double slash) in the filename.
CVE-2008-6361 1Insun Podcast 1Feedcms Apr 23, 2026 Mar 2, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in index.php in InSun Feed CMS 1.7.3 19Beta allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter.
CVE-2008-6336 1Rightscripts 1Text Lines Rearrange Script Apr 23, 2026 Feb 27, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Directory traversal vulnerability in download.php in Text Lines Rearrange Script 1.0, when register_globals is enabled, allows remote attackers to read arbitrary local files via directory traversal sequences in the filen...Show more Directory traversal vulnerability in download.php in Text Lines Rearrange Script 1.0, when register_globals is enabled, allows remote attackers to read arbitrary local files via directory traversal sequences in the filename parameter.Show less
CVE-2008-6335 1Emetrix 1Online Keyword Research Tool Apr 23, 2026 Feb 27, 2009 N/A· v4 N/A· v3 7.8 HIGH· v2 Directory traversal vulnerability in download.php in eMetrix Online Keyword Research Tool allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVE-2008-6334 1Emetrix 1Extract Website Apr 23, 2026 Feb 27, 2009 N/A· v4 N/A· v3 7.8 HIGH· v2 Directory traversal vulnerability in download.php in eMetrix Extract Website allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

Previous 1...506507508...542 Next