← Back
CWE-22

10,961 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

JSON object

Loading...

CVEs (10,961)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-31564
1Munhak
1Munhak Moa
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The woduq1414/munhak-moa repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31563
1Vprj Project
1Vprj
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The whmacmac/vprj repository through 2022-04-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31562
1Internshipsystem Project
1Internshipsystem
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The waveyan/internshipsystem repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31561
1Sphere Imagebackend Project
1Sphere Imagebackend
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31560
1Photo Tag Project
1Photo Tag
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The uncleYiba/photo_tag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31559
1Flask Yeoman Project
1Flask Yeoman
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The tsileo/flask-yeoman repository through 2013-09-13 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31558
1Shiva Server Project
1Shiva Server
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31557
1Golem Project
1Golem
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The seveas/golem repository through 2016-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31556
1Trainenergyserver Project
1Trainenergyserver
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The rusyasoft/TrainEnergyServer repository through 2017-08-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31555
1Nurse Quest Project
1Nurse Quest
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The romain20100/nursequest repository through 2018-02-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31554
1Movie Review Sentiment Analysis Project
1Movie Review Sentiment Analysis
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The rohitnayak/movie-review-sentiment-analysis repository through 2017-05-07 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31553
1Sleep Learner Project
1Sleep Learner
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The rainsoupah/sleep-learner repository through 2021-02-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31552
1Anuvaad Corpus Project
1Anuvaad Corpus
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The project-anuvaad/anuvaad-corpus repository through 2020-11-23 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31551
1Flask Mongo Skel Project
1Flask Mongo Skel
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31550
1Python Athena Stack Project
1Python Athena Stack
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31549
1Helm Flask Celery Project
1Helm Flask Celery
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The olmax99/helm-flask-celery repository before 2022-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31548
1Homepage Project
1Homepage
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The nrlakin/homepage repository through 2017-03-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31547
1Sphere Project
1Sphere
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The noamezekiel/sphere repository through 2020-05-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31546
1Glance Project
1Glance
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The nlpweb/glance repository through 2014-06-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31545
1Modelconverter Project
1Modelconverter
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.3 CRITICAL· v3
6.4 MEDIUM· v2
The ml-inory/ModelConverter repository through 2021-04-26 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.