Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (10,850)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-0984 1Honeywell 8Excel Web Xl 1000c1000 600 I/o Excel Web Xl 1000c1000 600 I/o UuklExcel Web Xl 1000c100 104 I/o+5 more May 6, 2026 Mar 31, 2015 N/A· v4 N/A· v3 10.0 HIGH· v2 Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300...Show more Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname.Show less
CVE-2014-9261 1Codologic 1Codoforum May 6, 2026 Mar 23, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.ph...Show more The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.php.Show less
CVE-2015-0665 1Cisco 1Anyconnect Secure Mobility Client May 6, 2026 Mar 17, 2015 N/A· v4 N/A· v3 6.6 MEDIUM· v2 The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173.
CVE-2015-2304 3Canonical LibarchiveOpensuse 3Libarchive OpensuseUbuntu Linux May 6, 2026 Mar 15, 2015 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.
CVE-2015-2243 1Webshophun 1Webshop Hun May 6, 2026 Mar 9, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php.
CVE-2015-0933 1Sharelatex 1Sharelatex May 6, 2026 Mar 4, 2015 N/A· v4 N/A· v3 3.5 LOW· v2 Absolute path traversal vulnerability in ShareLaTeX 0.1.3 and earlier, when the paranoid openin_any setting is omitted, allows remote authenticated users to read arbitrary files via a \include command.
CVE-2014-9282 1Speed Software 2Explorer Root Explorer May 6, 2026 Feb 24, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in the Speed Root Explorer application before 3.2 for Android and the Speed Explorer application before 2.2 for Android allows remote attackers to write to arbitrary files via a crafted...Show more Directory traversal vulnerability in the Speed Root Explorer application before 3.2 for Android and the Speed Explorer application before 2.2 for Android allows remote attackers to write to arbitrary files via a crafted filename.Show less
CVE-2015-2071 1Etouch 1Samepage May 6, 2026 Feb 24, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the filepath parameter.
CVE-2015-2067 1Magmi Project 1Magmi May 6, 2026 Feb 24, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVE-2015-1589 1Archmage Project 1Archmage May 6, 2026 Feb 23, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file.
CVE-2015-0878 1Almail 1Al Mail32 May 6, 2026 Feb 20, 2015 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Directory traversal vulnerability in CREAR AL-Mail32 before 1.13d allows remote attackers to write to arbitrary files via a crafted filename of an attachment.
CVE-2014-3578 1Pivotal Software 1Spring Framework May 6, 2026 Feb 19, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.
CVE-2014-6194 1Ibm 12Change And Configuration Management Database Maximo Asset ManagementMaximo Asset Management Essentials+9 more May 6, 2026 Feb 17, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Directory traversal vulnerability in an unspecified web form in IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX007, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 f...Show more Directory traversal vulnerability in an unspecified web form in IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX007, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to read arbitrary files via a .. (dot dot) in a pathname.Show less
CVE-2014-9375 1Lexmark 1Markvision Enterprise May 6, 2026 Feb 16, 2015 N/A· v4 N/A· v3 9.0 HIGH· v2 Directory traversal vulnerability in the LibraryFileUploadServlet servlet in Lexmark Markvision Enterprise allows remote authenticated users to write to and execute arbitrary files via a .. (dot dot) in a file path in a...Show more Directory traversal vulnerability in the LibraryFileUploadServlet servlet in Lexmark Markvision Enterprise allows remote authenticated users to write to and execute arbitrary files via a .. (dot dot) in a file path in a ZIP archive.Show less
CVE-2014-6154 1Ibm 1Optim Performance Manager May 6, 2026 Feb 13, 2015 N/A· v4 N/A· v3 7.8 HIGH· v2 Directory traversal vulnerability in IBM Optim Performance Manager for DB2 4.1.0.1 through 4.1.1 on Linux, UNIX, and Windows and IBM InfoSphere Optim Performance Manager for DB2 5.1 through 5.3.1 on Linux, UNIX, and Wind...Show more Directory traversal vulnerability in IBM Optim Performance Manager for DB2 4.1.0.1 through 4.1.1 on Linux, UNIX, and Windows and IBM InfoSphere Optim Performance Manager for DB2 5.1 through 5.3.1 on Linux, UNIX, and Windows allows remote attackers to access arbitrary files via a .. (dot dot) in a URL.Show less
CVE-2015-1579 1Elegantthemes 1Divi May 6, 2026 Feb 11, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-...Show more Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.Show less
CVE-2015-1577 1Yuba 1U5cms May 6, 2026 Feb 11, 2015 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to arbitrary files via a (1) .. (dot dot) or (2) full pathname in the f parameter.
CVE-2014-0605 1Attachmate 1Reflection Ftp Client May 6, 2026 Feb 6, 2015 N/A· v4 N/A· v3 10.0 HIGH· v2 Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the SaveSettings metho...Show more Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the SaveSettings method.Show less
CVE-2014-0604 1Attachmate 1Reflection Ftp Client May 6, 2026 Feb 6, 2015 N/A· v4 N/A· v3 10.0 HIGH· v2 Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the StartLog method.
CVE-2014-9574 1Fluxbb 1Fluxbb May 6, 2026 Feb 3, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.

Previous 1...454455456...543 Next