Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (10,863)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-8115 1Modx 1Modx Revolution May 13, 2026 Apr 25, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information.
CVE-2017-8104 1Mybb 1Mybb May 13, 2026 Apr 24, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.
CVE-2016-4313 1Extplorer 1Extplorer May 13, 2026 Apr 24, 2017 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archive file.
CVE-2015-7245 1D Link 1Dvg N5402sp Firmware May 13, 2026 Apr 24, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter.
CVE-2015-0107 1Ibm 11Change And Configuration Management Database Maximo Asset ManagementMaximo Asset Management Essentials+8 more May 13, 2026 Apr 24, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7....Show more IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to conduct directory traversal attacks via unspecified vectors.Show less
CVE-2016-5312 1Symantec 1Messaging Gateway May 13, 2026 Apr 14, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the sn parameter to brightmail/servl...Show more Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the sn parameter to brightmail/servlet/com.ve.kavachart.servlet.ChartStream.Show less
CVE-2015-8780 1Samsung 1Kies May 13, 2026 Apr 13, 2017 N/A· v4 6.4 MEDIUM· v3 6.9 MEDIUM· v2 Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury.
CVE-2015-8283 1Seawell Networks 1Spectrum Sdc May 13, 2026 Apr 13, 2017 N/A· v4 6.5 MEDIUM· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in configure_manage.php in SeaWell Networks Spectrum SDC 02.05.00.
CVE-2016-7552 1Trendmicro 1Threat Discovery Appliance May 13, 2026 Apr 12, 2017 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass au...Show more On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.Show less
CVE-2017-7462 1Intellinet Network 1Nfc 30ir Firmware May 13, 2026 Apr 11, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory.
CVE-2017-7461 1Intellinet Network 1Nfc 30ir Firmware May 13, 2026 Apr 11, 2017 N/A· v4 4.9 MEDIUM· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows remote attackers to read arbitrary files via a request to a vendor-supplied CGI sc...Show more Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows remote attackers to read arbitrary files via a request to a vendor-supplied CGI script that is used to read HTML text file, but that does not do any URI/path sanitization.Show less
CVE-2017-6190 1Dlink 1Dwr 116 Firmware May 13, 2026 Apr 10, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary files via a .. (dot dot) in a "GET /uir/" request.
CVE-2016-4320 1Atlassian 1Bitbucket May 13, 2026 Apr 10, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource.
CVE-2015-7270 1Dell 1Integrated Remote Access Controller Firmware May 13, 2026 Apr 10, 2017 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal.
CVE-2017-7577 1Xiongmaitech 1Uc Httpd May 13, 2026 Apr 7, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 XiongMai uc-httpd has directory traversal allowing the reading of arbitrary files via a "GET ../" HTTP request.
CVE-2017-7565 1Splunk 1Hadoop Connect May 13, 2026 Apr 6, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041.
CVE-2017-7358 2Canonical Lightdm Project 2Lightdm Ubuntu Linux May 13, 2026 Apr 5, 2017 N/A· v4 7.3 HIGH· v3 6.9 MEDIUM· v2 In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path locations and escalate privileges to root when the guest user logs out.
CVE-2017-4980 1Emc 1Isilon Onefs May 13, 2026 Mar 29, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 EMC Isilon OneFS is affected by a path traversal vulnerability that may potentially be exploited by attackers to compromise the affected system. Affected versions are 7.1.0 - 7.1.1.10, 7.2.0 - 7.2.1.3, and 8.0.0 - 8.0.0....Show more EMC Isilon OneFS is affected by a path traversal vulnerability that may potentially be exploited by attackers to compromise the affected system. Affected versions are 7.1.0 - 7.1.1.10, 7.2.0 - 7.2.1.3, and 8.0.0 - 8.0.0.1.Show less
CVE-2017-7258 1Auromeera 1Emli May 13, 2026 Mar 29, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerful commands on the web server which can lead to a full comprom...Show more HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerful commands on the web server which can lead to a full compromise of the system via Directory Path Traversal, as demonstrated by reading core-emli/Storage. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0.Show less
CVE-2017-5899 1S Nail Project 1S Nail May 13, 2026 Mar 27, 2017 N/A· v4 7.0 HIGH· v3 6.9 MEDIUM· v2 Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and consequently gain root privileges via a .. (dot dot) in the r...Show more Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and consequently gain root privileges via a .. (dot dot) in the randstr argument.Show less

Previous 1...442443444...544 Next