Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (10,890)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-11327 1Topcon 1Net G5 Firmware Jun 17, 2026 Sep 20, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vulnerability. An attacker with administrative privileges can cr...Show more An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vulnerability. An attacker with administrative privileges can craft a special URL to read arbitrary files from the device's files system.Show less
CVE-2019-14914 1Prise 1Adas Jun 17, 2026 Sep 20, 2019 N/A· v4 9.1 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, leading to an arbitrary file read and deletion via Directory Traversal.
CVE-2019-16511 1Firegiant 1Wix Toolset Jun 17, 2026 Sep 19, 2019 N/A· v4 5.5 MEDIUM· v3 5.8 MEDIUM· v2 An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction,...Show more An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file (even with a ../ sequence) is concatenated with the destination path.Show less
CVE-2019-14994 1Atlassian 1Jira Service Desk Jun 17, 2026 Sep 19, 2019 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3.16.8, from version 4.0.0 before version 4.1.3, from version...Show more The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3.16.8, from version 4.0.0 before version 4.1.3, from version 4.2.0 before version 4.2.5, from version 4.3.0 before version 4.3.4, and version 4.4.0 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via a path traversal vulnerability. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability.Show less
CVE-2018-1847 1Ibm 1Financial Transaction Manager For Multiplatform Nov 21, 2024 Sep 18, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.1.1.0 through 2.1.1.4, and v3.0.0.0 through 3.0.0.8 could allow a remote attacker to traverse directo...Show more IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.1.1.0 through 2.1.1.4, and v3.0.0.0 through 3.0.0.8 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 150946.Show less
CVE-2019-4442 1Ibm 1Websphere Application Server Jun 17, 2026 Sep 17, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the syst...Show more IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226.Show less
CVE-2019-4268 1Ibm 1Websphere Application Server Jun 17, 2026 Sep 17, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences (/../) to view ar...Show more IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 160201.Show less
CVE-2016-10977 1Neliosoftware 1Nelio Ab Testing Nov 21, 2024 Sep 17, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
CVE-2019-0207 1Apache 1Tapestry Jun 17, 2026 Sep 16, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any f...Show more Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.Show less
CVE-2016-10966 1Creativeinteractivemedia 1Real3d Flipbook Nov 21, 2024 Sep 16, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.
CVE-2016-10965 1Creativeinteractivemedia 1Real3d Flipbook Nov 21, 2024 Sep 16, 2019 N/A· v4 7.5 HIGH· v3 6.4 MEDIUM· v2 The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.
CVE-2019-5484 1Bower 1Bower Jun 17, 2026 Sep 13, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
CVE-2019-13532 1Codesys 13Control For Beaglebone Control For Empc A/imx6Control For Iot2000+10 more Jun 17, 2026 Sep 13, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.
CVE-2019-5956 1Wondercms 1Wondercms Jun 17, 2026 Sep 12, 2019 N/A· v4 6.5 MEDIUM· v3 7.5 HIGH· v2 Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors.
CVE-2019-1142 1Microsoft 1.net Framework Jun 17, 2026 Sep 11, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations, aka '.NET Framework Elevation of Privilege Vulnerability'.
CVE-2019-6783 1Gitlab 1Gitlab Jun 17, 2026 Sep 9, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote comman...Show more An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote command execution.Show less
CVE-2019-12464 1Librenms 1Librenms Jun 17, 2026 Sep 9, 2019 N/A· v4 7.5 HIGH· v3 6.0 MEDIUM· v2 An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resultin...Show more An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution.Show less
CVE-2019-16132 1Phpok 1Oklite Jun 17, 2026 Sep 9, 2019 N/A· v4 6.5 MEDIUM· v3 5.5 MEDIUM· v2 An issue was discovered in OKLite v1.2.25. framework/admin/tpl_control.php allows remote attackers to delete arbitrary files via a title directory-traversal pathname followed by a crafted substring.
CVE-2019-16123 1Kartatopia 1Piluscart Jun 17, 2026 Sep 9, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.
CVE-2019-16113 1Bludit 1Bludit Jun 17, 2026 Sep 8, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.

Previous 1...388389390...545 Next