Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (10,927)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-26806 1Objectplanet 1Opinio Jun 17, 2026 Jul 31, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP...Show more admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.Show less
CVE-2021-30483 1Isomorphic Git 1Isomorphic Git Jun 17, 2026 Jul 30, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
CVE-2021-28966 1Ruby Lang 1Ruby Jun 17, 2026 Jul 30, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
CVE-2021-23415 1Elfinder.aspnet Project 1Elfinder.aspnet Jun 17, 2026 Jul 28, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.
CVE-2021-37447 1Nchsoftware 1Quorum Jun 17, 2026 Jul 25, 2021 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
CVE-2021-37446 1Nchsoftware 1Quorum Jun 17, 2026 Jul 25, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
CVE-2021-37445 1Nchsoftware 1Quorum Jun 17, 2026 Jul 25, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
CVE-2021-37444 1Nchsoftware 1Ivm Attendant Jun 17, 2026 Jul 25, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a f...Show more NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Autodial function.Show less
CVE-2021-37443 1Nchsoftware 1Ivm Attendant Jun 17, 2026 Jul 25, 2021 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
CVE-2021-37442 1Nchsoftware 1Ivm Attendant Jun 17, 2026 Jul 25, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
CVE-2021-37441 1Nch 1Axon Pbx Jun 17, 2026 Jul 25, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.
CVE-2021-37440 1Nch 1Axon Pbx Jun 17, 2026 Jul 25, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.
CVE-2021-37439 1Nch 1Flexiserver Jun 17, 2026 Jul 25, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.
CVE-2021-37469 1Nch 1Webdictate Jun 17, 2026 Jul 25, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem.
CVE-2020-5370 1Dell 1Emc Openmanage Enterprise Jun 17, 2026 Jul 22, 2021 N/A· v4 6.8 MEDIUM· v3 6.0 MEDIUM· v2 Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to ove...Show more Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to overwrite arbitrary files via directory traversal sequences using a crafted tar file to inject malicious RPMs which may cause a denial of service or perform unauthorized actions.Show less
CVE-2021-1617 1Cisco 1Intersight Virtual Appliance Jun 17, 2026 Jul 22, 2021 N/A· v4 6.5 MEDIUM· v3 5.5 MEDIUM· v2 Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected sy...Show more Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by using the web-based management interface to do one or both of the following: Execute a command using crafted input Upload a file that has been altered using path traversal techniques A successful exploit could allow the attacker to read and write arbitrary files or execute arbitrary commands as root on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2021-35521 1Idemia 6Morphowave Compact Md Firmware Morphowave Compact Mdpi M FirmwareMorphowave Compact Mdpi Firmware+3 more Jun 17, 2026 Jul 22, 2021 N/A· v4 5.9 MEDIUM· v3 4.9 MEDIUM· v2 A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP pack...Show more A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets.Show less
CVE-2021-35054 1Minecraft 1Minecraft Jun 17, 2026 Jul 20, 2021 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files.
CVE-2021-34820 1Aat 1Novus Management System Jun 17, 2026 Jul 19, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for Arbitrary File Access vulnerability. A remote, unauthenticated attacker using an HTTP GET request ma...Show more Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for Arbitrary File Access vulnerability. A remote, unauthenticated attacker using an HTTP GET request may be able to exploit this issue to access sensitive data. The issue was discovered in the NMS (Novus Management System) software through 1.51.2Show less
CVE-2021-35968 1Learningdigital 1Orca Hcm Jun 17, 2026 Jul 19, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.

Previous 1...348349350...547 Next