Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (10,927)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-33555 1Pepperl Fuchs 2Wha Gw F2d2 0 As Z2 Eth.eip Firmware Wha Gw F2d2 0 As Z2 Eth Firmware Jun 17, 2026 Aug 31, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server.
CVE-2021-22022 1Vmware 3Cloud Foundation Vrealize Operations ManagerVrealize Suite Lifecycle Manager Jun 17, 2026 Aug 30, 2021 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize Operations Manager API can read any arbitrary file on server...Show more The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize Operations Manager API can read any arbitrary file on server leading to information disclosure.Show less
CVE-2020-18127 1Indexhibit 1Indexhibit Jun 17, 2026 Aug 30, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.
CVE-2021-40153 4Debian FedoraprojectRedhat+1 more 4Debian Linux Enterprise LinuxFedora+1 more Jun 17, 2026 Aug 27, 2021 N/A· v4 8.1 HIGH· v3 5.8 MEDIUM· v2 squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal o...Show more squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.Show less
CVE-2020-19547 1Popojicms 1Popojicms Jun 17, 2026 Aug 25, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.
CVE-2021-38612 1Nascent 1Remkon Device Manager Jun 17, 2026 Aug 24, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL.
CVE-2021-23430 1Startserver Project 1Startserver Jun 17, 2026 Aug 24, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.
CVE-2021-24549 1Aceide Project 1Aceide Jun 17, 2026 Aug 23, 2021 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows hi...Show more The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server outside of the blog directory via a path traversal attack.Show less
CVE-2020-18878 1Skycaiji 1Skycaiji Jun 17, 2026 Aug 20, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpStudy%5CWWW%5Cindex.php'.
CVE-2020-23069 1Webtareas Project 1Webtareas Jun 17, 2026 Aug 18, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a malicious user read arbitrary files.
CVE-2021-22933 2Ivanti Pulsesecure 2Connect Secure Pulse Connect Secure Jun 17, 2026 Aug 16, 2021 N/A· v4 6.5 MEDIUM· v3 5.5 MEDIUM· v2 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.
CVE-2021-38758 1Online Catering Reservation System Project 1Online Catering Reservation System Jun 17, 2026 Aug 16, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in Online Catering Reservation System 1.0 exists due to lack of validation in index.php.
CVE-2021-24363 110web 1Photo Gallery Jun 17, 2026 Aug 16, 2021 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in...Show more The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vectorShow less
CVE-2021-23423 1Bikeshed Project 1Bikeshed Jun 17, 2026 Aug 16, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the H...Show more This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output.Show less
CVE-2021-26086 1Atlassian 2Jira Data Center Jira Server Jun 17, 2026 Aug 16, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5...Show more Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.Show less
CVE-2021-27402 1Mitel 1Micollab Jun 17, 2026 Aug 13, 2021 N/A· v4 6.5 MEDIUM· v3 6.4 MEDIUM· v2 The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Tra...Show more The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal.Show less
CVE-2021-37347 1Nagios 1Nagios Xi Jun 17, 2026 Aug 13, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument.
CVE-2021-37343 1Nagios 1Nagios Xi Jun 17, 2026 Aug 13, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.
CVE-2021-31731 1Kitesky 1Kitecms Jun 17, 2026 Aug 12, 2021 N/A· v4 6.5 MEDIUM· v3 5.5 MEDIUM· v2 A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to index.php/admin/Template/fileedit, with PHP code in the html parameter.
CVE-2021-37367 1Ctparental Project 1Ctparental Jun 17, 2026 Aug 10, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. Because The file "bl_categories_help.php" is vulnerable to directory traversal, an attacker can create a file that co...Show more CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. Because The file "bl_categories_help.php" is vulnerable to directory traversal, an attacker can create a file that contains scripts and run arbitrary commands.Show less

Previous 1...346347348...547 Next