← Back
CWE-22

9,491 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

JSON object

Loading...

CVEs (9,491)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2010-1003
1Efrontlearning
1Efront
Apr 29, 2026
Mar 19, 2010
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in www/editor/tiny_mce/langs/language.php in eFront 3.5.x through 3.5.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langname parameter.
CVE-2009-4726
1Olivier Michaud Pierre Yves
1Quickdev4php
Apr 29, 2026
Mar 18, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in download.php in Quickdev 4 PHP allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVE-2009-4725
1Arabportal
1Arab Portal
Apr 29, 2026
Mar 18, 2010
N/A· v4
N/A· v3
5.1 MEDIUM· v2
Directory traversal vulnerability in modules/aljazeera/admin/setup.php in Arab Portal 2.2 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arb...Show more
Directory traversal vulnerability in modules/aljazeera/admin/setup.php in Arab Portal 2.2 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter.Show less
CVE-2009-4723
1Netpet
1Netpet Cms
Apr 29, 2026
Mar 18, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in confirm.php in Netpet CMS 1.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVE-2010-0985
1Chris Simon
1Com Abbrev
Apr 29, 2026
Mar 16, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to...Show more
Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.Show less
CVE-2010-0982
1Joomlamo
1Com Cartweberp
Apr 29, 2026
Mar 16, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVE-2010-0972
1G4j.laoneo
1Com Gcalendar
Apr 29, 2026
Mar 16, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index....Show more
Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.Show less
CVE-2010-0967
1Geekhelps
1Admp
Apr 29, 2026
Mar 16, 2010
N/A· v4
N/A· v3
5.1 MEDIUM· v2
Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the style p...Show more
Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the style parameter to (1) colorvoid/footer.php, (2) default-green/footer.php, (3) default-orange/footer.php, and (4) default/footer.php in themes/. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-4700
1Skadate
1Skadate Online Dating Software
Apr 29, 2026
Mar 15, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in index.php in SkaDate Dating allows remote attackers to read arbitrary files via a .. (dot dot) in the layout parameter.
CVE-2010-0396
1Debian
1Dpkg
Apr 29, 2026
Mar 15, 2010
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Directory traversal vulnerability in the dpkg-source component in dpkg before 1.14.29 allows remote attackers to modify arbitrary files via a crafted Debian source archive.
CVE-2009-4683
1Scriptsez
1Good/bad Vote
Apr 29, 2026
Mar 10, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in vote.php in Good/Bad Vote allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the id parameter in a dovote action. NOTE: some of...Show more
Directory traversal vulnerability in vote.php in Good/Bad Vote allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the id parameter in a dovote action. NOTE: some of these details are obtained from third party information.Show less
CVE-2010-0958
1Thomas Perez
1Tribisur
Apr 29, 2026
Mar 10, 2010
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in modules/hayoo/index.php in Tribisur 2.1, 2.0, and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary files via directory traversal se...Show more
Directory traversal vulnerability in modules/hayoo/index.php in Tribisur 2.1, 2.0, and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary files via directory traversal sequences in the theme parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2010-0957
1Saskia Bruckner
1Saskias Shopsystem
Apr 29, 2026
Mar 10, 2010
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in content.php in Saskia's Shopsystem beta1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the id parameter.
CVE-2010-0953
1Phpcoin
1Phpcoin
Apr 29, 2026
Mar 10, 2010
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in mod.php in phpCOIN 1.2.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the mod parameter.
CVE-2010-0926
1Samba
1Samba
Apr 29, 2026
Mar 10, 2010
N/A· v4
N/A· v3
3.5 LOW· v2
The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, an...Show more
The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.Show less
CVE-2010-0944
1Thorsten Riess
1Com Jcollection
Apr 29, 2026
Mar 8, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in the JCollection (com_jcollection) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVE-2010-0943
1Joomlart
1Com Jashowcase
Apr 29, 2026
Mar 8, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.p...Show more
Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.php.Show less
CVE-2010-0942
1Jvideodirect
1Com Jvideodirect
Apr 29, 2026
Mar 8, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVE-2009-4679
1Inertialfate
1Com If Nexus
Apr 29, 2026
Mar 8, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller...Show more
Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.Show less
CVE-2010-0933
1Perforce
1Perforce Server
Apr 29, 2026
Mar 5, 2010
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in Perforce Server 2008.1 allows remote authenticated users to create arbitrary files via a .. (dot dot) in the argument to the "p4 add" command.