Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (10,828)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-6177 1Publicwarehouse 1Lightblog Apr 23, 2026 Feb 19, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) username parameter to vi...Show more Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) username parameter to view_member.php, (2) username_post parameter to login.php, and the (3) Lightblog_username cookie parameter to check_user.php.Show less
CVE-2008-6172 1Weberr 1Rwcards Apr 23, 2026 Feb 19, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local...Show more Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter.Show less
CVE-2008-6167 1Miniportail 1Miniportail Apr 23, 2026 Feb 19, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lng parameter.
CVE-2009-0645 1Jaws 1Jaws Apr 23, 2026 Feb 18, 2009 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) language, (2) Introduction_complete, and (3) use_log parameters, differ...Show more Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) language, (2) Introduction_complete, and (3) use_log parameters, different vectors than CVE-2004-2445.Show less
CVE-2009-0596 1Phpskelsite 1Phpskelsite Apr 23, 2026 Feb 16, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in...Show more Directory traversal vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the TplSuffix parameter.Show less
CVE-2009-0592 1Pnphpbb 1Pnphpbb2 Apr 23, 2026 Feb 16, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_...Show more Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_groups_reapir.php, (3) admin_smilies.php, (4) admin_ranks.php, (5) admin_styles.php, and (6) admin_users.php in admin/.Show less
CVE-2008-6139 1Webbiscuits 1Modules Controller Apr 23, 2026 Feb 14, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in faqsupport/wce.download.php in WebBiscuits Modules Controller 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the download parameter.
CVE-2008-6129 1Mozilo 1Mozilowiki Apr 23, 2026 Feb 13, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Directory traversal vulnerability in print.php in moziloWiki 1.0.1 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
CVE-2008-6126 1Mozilo 1Mozilocms Apr 23, 2026 Feb 13, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Multiple directory traversal vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter to download.php and the (2) page parameter to index...Show more Multiple directory traversal vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter to download.php and the (2) page parameter to index.php, a different vector than CVE-2008-3589.Show less
CVE-2009-0570 1Ninjadesigns 1Mailist Apr 23, 2026 Feb 13, 2009 N/A· v4 N/A· v3 5.1 MEDIUM· v2 Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .....Show more Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the load parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-0535 1Extrosoft 1Thyme Apr 23, 2026 Feb 11, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in export.php in Thyme 1.3 and earlier, when register_globals is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the export_to parameter.
CVE-2008-6112 1Scriptsez 1Ez Ringtone Manager Apr 23, 2026 Feb 11, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Multiple directory traversal vulnerabilities in Ez Ringtone Manager allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a detail action to (1) main.php and (2) template.php in rington...Show more Multiple directory traversal vulnerabilities in Ez Ringtone Manager allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a detail action to (1) main.php and (2) template.php in ringtones/.Show less
CVE-2009-0515 1Yanocc 1Yanocc Apr 23, 2026 Feb 11, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVE-2009-0514 1Webframe 1Webframe Apr 23, 2026 Feb 11, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) currentmod and (2) LANG parameters to mod/ind...Show more Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) currentmod and (2) LANG parameters to mod/index.php.Show less
CVE-2009-0457 1Magtrb 1Aja Portal Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the currentlang parameter to admin/case.php in the (...Show more Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the currentlang parameter to admin/case.php in the (1) Contact_Plus and (2) Reviews modules, and (3) the module_name parameter to admin/includes/FANCYNLOptions.php in the Fancy_NewsLetter module.Show less
CVE-2009-0448 1Syntax Desktop 1Syntax Desktop Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the synTarget parameter.
CVE-2009-0442 1Phpbbbook 1Phpbbbook Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in bbcode.php in PHPbbBook 1.3 and 1.3h allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the l parameter.
CVE-2009-0497 1Igniterealtime 1Openfire Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the log parameter.
CVE-2008-6090 1Scriptsez 1Mini Hosting Panel Apr 23, 2026 Feb 6, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Directory traversal vulnerability in members.php in ScriptsEz Mini Hosting Panel allows remote attackers to read arbitrary local files via a .. (dot dot) in the dir parameter in a view action.
CVE-2008-6089 1Scriptsez 1Easy Image Downloader Apr 23, 2026 Feb 6, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in main.php in ScriptsEz Easy Image Downloader allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a download action.

Previous 1...508509510...542 Next