← Back
CWE-22

9,484 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

JSON object

Loading...

CVEs (9,484)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-1748
1Joost Horward
1Catviz
Apr 23, 2026
May 22, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) webpages_form or (2) userman_form parameter.
CVE-2009-1161
1Cisco
10Ciscoworks Common Services
Ciscoworks Health And Utilization MonitorCiscoworks Lan Management Solution+7 more
Apr 23, 2026
May 21, 2009
N/A· v4
N/A· v3
10.0 HIGH· v2
Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessme...Show more
Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, Unified Provisioning Manager, and other products, allows remote attackers to access arbitrary files via unspecified vectors.Show less
CVE-2009-1744
1Pinnaclesys
1Pinnacle Studio
Apr 23, 2026
May 21, 2009
N/A· v4
N/A· v3
4.3 MEDIUM· v2
InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to cause a denial of service (application crash) via a crafted Hollywood FX Compressed Ar...Show more
InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to cause a denial of service (application crash) via a crafted Hollywood FX Compressed Archive (.hfz) file.Show less
CVE-2009-1743
1Pinnaclesys
1Pinnacle Studio
Apr 23, 2026
May 21, 2009
N/A· v4
N/A· v3
9.3 HIGH· v2
Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to create and overwrite arbitrary files via a filena...Show more
Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to create and overwrite arbitrary files via a filename containing a ..\ (dot dot backslash) sequence in a Hollywood FX Compressed Archive (.hfz) file. NOTE: this can be leveraged for code execution by decompressing a file to a Startup folder. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-1737
1Diqiye
1Mypic
Apr 23, 2026
May 20, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
Directory traversal vulnerability in bom.php in MyPic 2.1 allows remote attackers to list files in arbitrary directories via a .. (dot dot) in the dir parameter.
CVE-2009-1730
1Netmechanica
1Netdecision Tftp Server
Apr 23, 2026
May 20, 2009
N/A· v4
N/A· v3
10.0 HIGH· v2
Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command.
CVE-2009-1678
1Bitweaver
1Bitweaver
Apr 23, 2026
May 18, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the version parame...Show more
Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the version parameter to boards/boards_rss.php.Show less
CVE-2009-1653
1Tinybutstrong
1Tinybutstrong
Apr 23, 2026
May 16, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
Directory traversal vulnerability in examples/tbs_us_examples_0view.php in TinyButStrong 3.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the script parameter.
CVE-2009-1649
1Bicluc
1Belive
Apr 23, 2026
May 16, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the arch parameter.
CVE-2009-1625
1Davlin
1Thickbox Gallery
Apr 23, 2026
May 12, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in index.php in Thickbox Gallery 2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ln parameter.
CVE-2009-1624
1Dew Code
1Dew Newphplinks
Apr 23, 2026
May 12, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the show parameter.
CVE-2009-1621
1Opencart
1Opencart
Apr 23, 2026
May 12, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in index.php in OpenCart 1.1.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the route parameter.
CVE-2009-1559
1Cisco
1Wvc54gca
Apr 23, 2026
May 6, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
Absolute path traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R24 and possibly 1.00R22 allows remote attackers to read arbitrary files via an absolute pathnam...Show more
Absolute path traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R24 and possibly 1.00R22 allows remote attackers to read arbitrary files via an absolute pathname in the this_file parameter. NOTE: traversal via a .. (dot dot) is probably also possible.Show less
CVE-2009-1558
1Cisco
1Wvc54gca
Apr 23, 2026
May 6, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote attackers to read arbitrary files via a %2e. (encoded dot dot) or an a...Show more
Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote attackers to read arbitrary files via a %2e. (encoded dot dot) or an absolute pathname in the next_file parameter.Show less
CVE-2009-1523
1Mortbay
1Jetty
Apr 23, 2026
May 5, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
CVE-2009-1519
1Pecio Cms
1Pecio Cms
Apr 23, 2026
May 4, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in index.php in Pecio CMS 1.1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.
CVE-2009-1510
1Koschtit
1Koschtit Image Gallery
Apr 23, 2026
May 1, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the file parameter to (1) ki_makepic.ph...Show more
Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the file parameter to (1) ki_makepic.php and (2) ki_nojsdisplayimage.php in ki_base/.Show less
CVE-2008-6786
1Codewiz
1Geekigeeki
Apr 23, 2026
May 1, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Multiple directory traversal vulnerabilities in geekigeeki.py in GeekiGeeki before 3.0 allow remote attackers to read arbitrary files via directory traversal sequences in a pagename argument in the (1) handle_edit and (2...Show more
Multiple directory traversal vulnerabilities in geekigeeki.py in GeekiGeeki before 3.0 allow remote attackers to read arbitrary files via directory traversal sequences in a pagename argument in the (1) handle_edit and (2) handle_raw functions.Show less
CVE-2009-1502
1.matteoiammarrone
1S Cms
Apr 23, 2026
May 1, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
CVE-2009-1498
1Idb
1Idb
Apr 23, 2026
May 1, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) i...Show more
Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter in a settings action to profile.php.Show less