← Back
CWE-22

9,483 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

JSON object

Loading...

CVEs (9,483)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2007-6672
1Mortbay Jetty
1Jetty
Apr 23, 2026
Jan 8, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
CVE-2008-0094
1Modxcms
1Modxcms
Apr 23, 2026
Jan 8, 2008
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the as_language parameter to assets/sni...Show more
Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the as_language parameter to assets/snippets/AjaxSearch/AjaxSearch.php, reached through index-ajax.php; and (2) read arbitrary local files via a .. (dot dot) in the file parameter to assets/js/htcmime.php.Show less
CVE-2007-6662
1Cutephp
1Cutenews
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in d...Show more
Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php.Show less
CVE-2007-6653
1Mihalism
1Multi Host
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVE-2007-6651
1Bitweaver
1Bitweaver
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive information (script source code) via a .. (dot dot) in the suck_url parameter.
CVE-2007-6648
1Sanybee Gallery
1Sanybee Gallery
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.
CVE-2008-0091
1Agency4net
1Webftp
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the file parameter.
CVE-2007-6624
1Pnphpbb
1Pnphpbb
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.
CVE-2007-6623
1Zeuscms
1Zeuscms
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the dir parameter.
CVE-2007-6621
1Joovili
1Joovili
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Directory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.
CVE-2007-6620
1Joovili
1Joovili
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.
CVE-2007-6612
1Mongrel
1Mongrel
Apr 23, 2026
Jan 3, 2008
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences ("...Show more
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").Show less
CVE-2007-6604
1Xcms
1Xcms
Apr 23, 2026
Dec 31, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the s parameter to the admin page or (2) the pg parameter to an...Show more
Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the s parameter to the admin page or (2) the pg parameter to an arbitrary module, as demonstrated by reading a password hash in a .dtb file under dati/membri/ or by executing embedded PHP code in images under uploads/avatar/.Show less
CVE-2007-6584
11024 Cms
11024 Cms
Apr 23, 2026
Dec 28, 2007
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang parameter to pages/print/default/ops/news.php or (2) t...Show more
Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang parameter to pages/print/default/ops/news.php or (2) the theme_dir parameter to pages/download/default/ops/search.php; or the admin_theme_dir parameter to (3) download.php, (4) forum.php, or (5) news.php in admin/ops/reports/ops/. NOTE: it was later reported that 1.4.2 beta and earlier are also affected for vector 1.Show less
CVE-2007-6582
1C97net
1Mblog
Apr 23, 2026
Dec 28, 2007
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter in a page mode action.
CVE-2007-6581
1Social Engine
1Social Engine
Apr 23, 2026
Dec 28, 2007
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the global_lang parameter to (1) header_album.php, (2) header_bl...Show more
Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the global_lang parameter to (1) header_album.php, (2) header_blog.php, or (3) header_group.php; or (4) admin_header_album.php, (5) admin_header_blog.php, or (6) admin_header_group.php in admin/.Show less
CVE-2007-6567
1Xzero Scripts
1Xzero Community Classifieds
Apr 23, 2026
Dec 28, 2007
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagename parameter in a pag...Show more
Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagename parameter in a page view action.Show less
CVE-2007-6554
1George Lewe
1Teamcal Pro
Apr 23, 2026
Dec 28, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to (1) index.php, (2) register....Show more
Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to (1) index.php, (2) register.php, (3) login.php, or (4) statistics.php.Show less
CVE-2007-6552
1Auracms
1Auracms
Apr 23, 2026
Dec 28, 2007
N/A· v4
N/A· v3
6.0 MEDIUM· v2
Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the act parameter, possibly involving the news pilih comp...Show more
Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the act parameter, possibly involving the news pilih component; as demonstrated by including admin/admin_users.php to bypass a protection mechanism against direct request.Show less
CVE-2007-6528
1Tiki
1Tikiwiki Cms/groupware
Apr 23, 2026
Dec 27, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) and modified filename in the movie parameter.