Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (9,540)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-9489 1Trendmicro 5Apex One Apex One As A ServiceBusiness Security+2 more Jun 17, 2026 Apr 5, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (versions XG and 11.0), and Worry-Free Business Security (versions 10.0, 9.5 and 9.0) could allow an attacker to modify arbitrary files on the affec...Show more A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (versions XG and 11.0), and Worry-Free Business Security (versions 10.0, 9.5 and 9.0) could allow an attacker to modify arbitrary files on the affected product's management console.Show less
CVE-2018-20229 1Gitlab 1Gitlab Nov 21, 2024 Apr 4, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal.
CVE-2019-5423 1Http Live Simulator Project 1Http Live Simulator Jun 17, 2026 Apr 3, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Path traversal vulnerability in http-live-simulator npm package version 1.0.5 allows arbitrary path to be accessed on the file system by a remote attacker.
CVE-2018-1618 1Ibm 1Security Privileged Identity Manager Nov 21, 2024 Apr 2, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences...Show more IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 144343.Show less
CVE-2019-5889 1Overit 1Geocall Jun 17, 2026 Apr 1, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An log-management directory traversal issue was discovered in OverIT Geocall 6.3 before build 2:346977.
CVE-2018-13299 1Synology 1Calendar Nov 21, 2024 Apr 1, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter.
CVE-2019-9922 1Harmistechnology 1Je Messenger Jun 17, 2026 Mar 29, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access to arbitrary files.
CVE-2019-0225 1Apache 1Jspwiki Jun 17, 2026 Mar 28, 2019 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
CVE-2018-20144 1Gitlab 1Gitlab Nov 21, 2024 Mar 28, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.
CVE-2019-1010257 1Article2pdf Project 1Article2pdf Jun 17, 2026 Mar 27, 2019 N/A· v4 9.1 CRITICAL· v3 7.5 HIGH· v2 An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leadi...Show more An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can be downloaded. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.Show less
CVE-2019-5927 1Weban 1An Jun 17, 2026 Mar 27, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2019-5418 5Debian FedoraprojectOpensuse+2 more 6Cloudforms Debian LinuxFedora+3 more Jun 17, 2026 Mar 27, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesyste...Show more There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.Show less
CVE-2019-3828 1Redhat 1Ansible Jun 17, 2026 Mar 27, 2019 N/A· v4 4.2 MEDIUM· v3 3.3 LOW· v2 Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not r...Show more Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.Show less
CVE-2018-19856 1Gitlab 1Gitlab Nov 21, 2024 Mar 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API.
CVE-2019-3396 1Atlassian 1Confluence Server Jun 17, 2026 Mar 25, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed...Show more The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.Show less
CVE-2018-16858 1Libreoffice 1Libreoffice Nov 21, 2024 Mar 25, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, wh...Show more It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.Show less
CVE-2019-6240 1Gitlab 1Gitlab Jun 17, 2026 Mar 25, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.
CVE-2019-3482 1Hp 1Arcsight Logger Jun 17, 2026 Mar 25, 2019 N/A· v4 6.5 MEDIUM· v3 6.8 MEDIUM· v2 Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.
CVE-2019-9960 1Limesurvey 1Limesurvey Jun 17, 2026 Mar 24, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
CVE-2019-9948 6Canonical DebianFedoraproject+3 more 11Debian Linux Enterprise Linux DesktopEnterprise Linux Eus+8 more Jun 17, 2026 Mar 23, 2019 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('l...Show more urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.Show less

Previous 1...332333334...477 Next