← Back
CWE-22

9,526 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

JSON object

Loading...

CVEs (9,526)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-2243
1Webshophun
1Webshop Hun
May 6, 2026
Mar 9, 2015
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php.
CVE-2015-0933
1Sharelatex
1Sharelatex
May 6, 2026
Mar 4, 2015
N/A· v4
N/A· v3
3.5 LOW· v2
Absolute path traversal vulnerability in ShareLaTeX 0.1.3 and earlier, when the paranoid openin_any setting is omitted, allows remote authenticated users to read arbitrary files via a \include command.
CVE-2014-9282
1Speed Software
2Explorer
Root Explorer
May 6, 2026
Feb 24, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in the Speed Root Explorer application before 3.2 for Android and the Speed Explorer application before 2.2 for Android allows remote attackers to write to arbitrary files via a crafted...Show more
Directory traversal vulnerability in the Speed Root Explorer application before 3.2 for Android and the Speed Explorer application before 2.2 for Android allows remote attackers to write to arbitrary files via a crafted filename.Show less
CVE-2015-2071
1Etouch
1Samepage
May 6, 2026
Feb 24, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the filepath parameter.
CVE-2015-2067
1Magmi Project
1Magmi
May 6, 2026
Feb 24, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVE-2015-1589
1Archmage Project
1Archmage
May 6, 2026
Feb 23, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file.
CVE-2015-0878
1Almail
1Al Mail32
May 6, 2026
Feb 20, 2015
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Directory traversal vulnerability in CREAR AL-Mail32 before 1.13d allows remote attackers to write to arbitrary files via a crafted filename of an attachment.
CVE-2014-3578
1Pivotal Software
1Spring Framework
May 6, 2026
Feb 19, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.
CVE-2014-6194
1Ibm
12Change And Configuration Management Database
Maximo Asset ManagementMaximo Asset Management Essentials+9 more
May 6, 2026
Feb 17, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
Directory traversal vulnerability in an unspecified web form in IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX007, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 f...Show more
Directory traversal vulnerability in an unspecified web form in IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX007, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to read arbitrary files via a .. (dot dot) in a pathname.Show less
CVE-2014-9375
1Lexmark
1Markvision Enterprise
May 6, 2026
Feb 16, 2015
N/A· v4
N/A· v3
9.0 HIGH· v2
Directory traversal vulnerability in the LibraryFileUploadServlet servlet in Lexmark Markvision Enterprise allows remote authenticated users to write to and execute arbitrary files via a .. (dot dot) in a file path in a...Show more
Directory traversal vulnerability in the LibraryFileUploadServlet servlet in Lexmark Markvision Enterprise allows remote authenticated users to write to and execute arbitrary files via a .. (dot dot) in a file path in a ZIP archive.Show less
CVE-2014-6154
1Ibm
1Optim Performance Manager
May 6, 2026
Feb 13, 2015
N/A· v4
N/A· v3
7.8 HIGH· v2
Directory traversal vulnerability in IBM Optim Performance Manager for DB2 4.1.0.1 through 4.1.1 on Linux, UNIX, and Windows and IBM InfoSphere Optim Performance Manager for DB2 5.1 through 5.3.1 on Linux, UNIX, and Wind...Show more
Directory traversal vulnerability in IBM Optim Performance Manager for DB2 4.1.0.1 through 4.1.1 on Linux, UNIX, and Windows and IBM InfoSphere Optim Performance Manager for DB2 5.1 through 5.3.1 on Linux, UNIX, and Windows allows remote attackers to access arbitrary files via a .. (dot dot) in a URL.Show less
CVE-2015-1579
1Elegantthemes
1Divi
May 6, 2026
Feb 11, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-...Show more
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.Show less
CVE-2015-1577
1Yuba
1U5cms
May 6, 2026
Feb 11, 2015
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to arbitrary files via a (1) .. (dot dot) or (2) full pathname in the f parameter.
CVE-2014-0605
1Attachmate
1Reflection Ftp Client
May 6, 2026
Feb 6, 2015
N/A· v4
N/A· v3
10.0 HIGH· v2
Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the SaveSettings metho...Show more
Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the SaveSettings method.Show less
CVE-2014-0604
1Attachmate
1Reflection Ftp Client
May 6, 2026
Feb 6, 2015
N/A· v4
N/A· v3
10.0 HIGH· v2
Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the StartLog method.
CVE-2014-9574
1Fluxbb
1Fluxbb
May 6, 2026
Feb 3, 2015
N/A· v4
N/A· v3
9.3 HIGH· v2
Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.
CVE-2015-1365
1Pixabay Images Project
1Pixabay Images
May 6, 2026
Jan 27, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.
CVE-2015-1195
1Openstack
1Image Registry And Delivery Service (glance)
May 6, 2026
Jan 21, 2015
N/A· v4
N/A· v3
6.5 MEDIUM· v2
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: U...Show more
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.Show less
CVE-2015-1193
1Pax Project
1Pax
May 6, 2026
Jan 21, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
CVE-2015-1192
1Kgb Project
1Kgb
May 6, 2026
Jan 21, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archive.