Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVEs (9,483)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2007-6508 1Xecms 1Xecms Apr 23, 2026 Dec 21, 2007 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F (dot dot slash) in the list parameter.
CVE-2007-6483 1Safenet 2Sentinel Keys Server Sentinel Protection Server Apr 23, 2026 Dec 20, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and possibly earlier versions, and Sentinel Keys Server 1.0.3 and possibly earlier versions, allows remote attackers to read arb...Show more Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and possibly earlier versions, and Sentinel Keys Server 1.0.3 and possibly earlier versions, allows remote attackers to read arbitrary files via a .. (dot dot) in the query string.Show less
CVE-2007-6475 1Gf 3xplorer 1Gf 3xplorer Apr 23, 2026 Dec 20, 2007 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Multiple directory traversal vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang_sel parameter to (1) updater.php and (2) thumber.php.
CVE-2007-6471 1Phpay 1Phpay Apr 23, 2026 Dec 20, 2007 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ (dot dot backslash) in the...Show more Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ (dot dot backslash) in the config parameter.Show less
CVE-2007-6453 1Raiden Professional Servers 1Raidenhttpd Apr 23, 2026 Dec 20, 2007 N/A· v4 N/A· v3 10.0 HIGH· v2 Directory traversal vulnerability in raidenhttpd-admin/workspace.php in RaidenHTTPD 2.0.19, when the WebAdmin function is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) i...Show more Directory traversal vulnerability in raidenhttpd-admin/workspace.php in RaidenHTTPD 2.0.19, when the WebAdmin function is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ulang parameter.Show less
CVE-2007-4709 1Apple 1Mac Os X Apr 23, 2026 Dec 19, 2007 N/A· v4 N/A· v3 8.8 HIGH· v2 Directory traversal vulnerability in CFNetwork in Apple Mac OS X 10.5.1 allows remote attackers to overwrite arbitrary files via a crafted HTTP response.
CVE-2007-6404 1Shttp 1Shttp Apr 23, 2026 Dec 17, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the URI.
CVE-2007-6400 1Poldoc 1Poldoc Document Management System Apr 23, 2026 Dec 17, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in download_file.php in PolDoc CMS (aka PDDMS) 0.96 allows remote attackers to read arbitrary files via a .. (dot dot) or absolute pathname in the filename parameter.
CVE-2007-6397 1Flat Php 1Board Apr 23, 2026 Dec 17, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Multiple directory traversal vulnerabilities in index.php in Flat PHP Board 1.2 and earlier allow remote attackers to (1) create arbitrary files via a .. (dot dot) in the username parameter when registering a user accoun...Show more Multiple directory traversal vulnerabilities in index.php in Flat PHP Board 1.2 and earlier allow remote attackers to (1) create arbitrary files via a .. (dot dot) in the username parameter when registering a user account, and (2) read arbitrary PHP files via a .. (dot dot) in (a) the topic parameter in a topic action or (b) the username parameter in a viewprofile action.Show less
CVE-2007-6378 1Badblue 1Badblue Apr 23, 2026 Dec 15, 2007 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in upload.dll in BadBlue 2.72b and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the filename parameter.
CVE-2007-6376 1Francisco Burzi 1Php Nuke Apr 23, 2026 Dec 15, 2007 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in autohtml.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the filename parameter, a different vector than...Show more Directory traversal vulnerability in autohtml.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the filename parameter, a different vector than CVE-2006-4190. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2007-6369 1Wordpress 1Pictpress Apr 23, 2026 Dec 15, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Multiple directory traversal vulnerabilities in resize.php in the PictPress 0.91 and earlier plugin for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) size or (2) path parameter.
CVE-2007-6368 1Ezcontents 1Ezcontents Apr 23, 2026 Dec 15, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in index.php in ezContents 1.4.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the link parameter.
CVE-2007-6344 1Mcms 1Easy Web Make Apr 23, 2026 Dec 13, 2007 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the template parameter.
CVE-2007-6331 1Hp 2Info Center Quick Launch Button Apr 23, 2026 Dec 13, 2007 N/A· v4 N/A· v3 9.3 HIGH· v2 Absolute path traversal vulnerability in the HPInfoDLL.HPInfo.1 ActiveX control in HPInfoDLL.dll 1.0, as shipped with HP Info Center (hpinfocenter.exe) 1.0.1.1 in HP Quick Launch Button (QLBCTRL.exe, aka QLB) 6.3 and ear...Show more Absolute path traversal vulnerability in the HPInfoDLL.HPInfo.1 ActiveX control in HPInfoDLL.dll 1.0, as shipped with HP Info Center (hpinfocenter.exe) 1.0.1.1 in HP Quick Launch Button (QLBCTRL.exe, aka QLB) 6.3 and earlier allows remote attackers to execute arbitrary programs via the first argument to the LaunchApp method. NOTE: only a user-assisted attack is possible on Windows Vista.Show less
CVE-2007-6323 1Mms Gallery 1Mms Gallery Php Apr 23, 2026 Dec 13, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Multiple directory traversal vulnerabilities in MMS Gallery PHP 1.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter to (1) get_image.php or (2) get_file.php in mms_template/.
CVE-2007-6322 1Xml2owl 1Xml2owl Apr 23, 2026 Dec 13, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in filedownload.php in xml2owl 0.1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVE-2007-6317 1Real Time Logic 2Barracudadrive Web Server Barracudadrive Web Server Home Server Apr 23, 2026 Dec 12, 2007 N/A· v4 N/A· v3 5.5 MEDIUM· v2 Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow (1) remote attackers to read arbitrary files via certain ..\ (dot dot backslash) sequences in the URL path, or (2) remote authent...Show more Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow (1) remote attackers to read arbitrary files via certain ..\ (dot dot backslash) sequences in the URL path, or (2) remote authenticated users to delete arbitrary files or create arbitrary directories via a ..\ (dot dot backslash) sequence in the dir parameter to /drive/c/bdusers/USER/.Show less
CVE-2007-6290 1Iptel 1Serweb Apr 23, 2026 Dec 10, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Multiple directory traversal vulnerabilities in js/get_js.php in SERWeb 2.0.0 dev1 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) mod and (2) js parameters.
CVE-2007-6268 1Xigla 1Absolute News Manager.net Apr 23, 2026 Dec 7, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.

Previous 1...462463464...475 Next