Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (9,575)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-40742 1Softnext 1Mail Sqr Expert Jun 17, 2026 Oct 31, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to ac...Show more Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.Show less
CVE-2022-39023 1Edetw 1U Office Force Jun 17, 2026 Oct 31, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file.
CVE-2022-39022 1Edetw 1U Office Force Jun 17, 2026 Oct 31, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file.
CVE-2022-39367 1Qtiworks Project 1Qtiworks Jun 17, 2026 Oct 28, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packages as ZIP files. The ZIP handling code does not sufficiently...Show more QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packages as ZIP files. The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, so can insert files into other locations in the filesystem if they are writable by the process running the QTIWorks Engine. In extreme cases, this could allow anonymous users to change files in arbitrary locations in the filesystem. In normal QTIWorks Engine deployments, the impact is somewhat reduced because the default QTIWorks configuration does not enable the public demo functionality, so ZIP files can only be uploaded by users with "instructor" privileges. This vulnerability is fixed in version 1.0-beta15. There are no database configuration changes required when upgrading to this version. No known workarounds for this issue exist.Show less
CVE-2022-26884 1Apache 1Dolphinscheduler Jun 17, 2026 Oct 28, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.
CVE-2021-38399 1Honeywell 4Application Control Environment Firmware C200 FirmwareC200e Firmware+1 more Jun 17, 2026 Oct 28, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories.
CVE-2022-3387 1Advantech 1R Seenet Jun 17, 2026 Oct 27, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. An unauthorized attacker could remotely exploit vulnerable PHP code to delete .PDF files.
CVE-2022-0072 1Litespeedtech 1Openlitespeed Jun 17, 2026 Oct 27, 2022 N/A· v4 5.8 MEDIUM· v3 N/A· v2 Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20....Show more Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1Show less
CVE-2022-20955 1Cisco 2Roomos Telepresence Collaboration Endpoint Jun 17, 2026 Oct 26, 2022 N/A· v4 7.1 HIGH· v3 N/A· v2 Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an...Show more Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2022-20954 1Cisco 2Roomos Telepresence Collaboration Endpoint Jun 17, 2026 Oct 26, 2022 N/A· v4 7.1 HIGH· v3 N/A· v2 Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an...Show more Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2022-20953 1Cisco 2Roomos Telepresence Collaboration Endpoint Jun 17, 2026 Oct 26, 2022 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an...Show more Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2022-20822 1Cisco 1Identity Services Engine Jun 17, 2026 Oct 26, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete files on an affected device. This vulnerability is due to ins...Show more A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete files on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains certain character sequences to an affected system. A successful exploit could allow the attacker to read or delete specific files on the device that their configured administrative level should not have access to. Cisco plans to release software updates that address this vulnerability.Show less
CVE-2022-20811 1Cisco 2Roomos Telepresence Collaboration Endpoint Jun 17, 2026 Oct 26, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an...Show more Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2022-20776 1Cisco 2Roomos Telepresence Collaboration Endpoint Jun 17, 2026 Oct 26, 2022 N/A· v4 6.7 MEDIUM· v3 N/A· v2 Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an...Show more Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2022-43748 1Synology 1Presto File Server Jun 17, 2026 Oct 26, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files via unspecified vectors.Show less
CVE-2022-39345 1Gin Vue Admin Project 1Gin Vue Admin Jun 17, 2026 Oct 25, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerab...Show more Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.Show less
CVE-2022-38196 1Esri 1Arcgis Server Jun 17, 2026 Oct 25, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
CVE-2022-33897 1Robustel 1R1510 Firmware Jun 17, 2026 Oct 25, 2022 N/A· v4 9.1 CRITICAL· v3 N/A· v2 A directory traversal vulnerability exists in the web_server /ajax/remove/ functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence...Show more A directory traversal vulnerability exists in the web_server /ajax/remove/ functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability.Show less
CVE-2022-41780 1F5 2F5os A F5os C Jun 17, 2026 Oct 19, 2022 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI that allows an attacker to read arbitrary files.
CVE-2022-42188 1Lavalite 1Lavalite Jun 17, 2026 Oct 18, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

Previous 1...237238239...479 Next