← Back
CWE-22

10,842 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

JSON object

Loading...

CVEs (10,842)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2011-4166
1Hp
1Managed Printing Administration
Apr 29, 2026
Dec 27, 2011
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.
CVE-2011-3837
1Wuzly
1Wuzly
Apr 29, 2026
Dec 24, 2011
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in blog_system/data_functions.php in Wuzly 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the preview parameter to index.php.
CVE-2011-4596
1Openstack
1Nova
Apr 29, 2026
Dec 23, 2011
N/A· v4
N/A· v3
6.0 MEDIUM· v2
Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary fil...Show more
Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.Show less
CVE-2011-4717
1Zftpserver
1Zftpserver Suite
Apr 29, 2026
Dec 20, 2011
N/A· v4
N/A· v3
5.5 MEDIUM· v2
Directory traversal vulnerability in zFTPServer Suite 6.0.0.52 allows remote authenticated users to delete arbitrary directories via a crafted RMD (aka rmdir) command.
CVE-2011-4835
1Homeseer
1Homeseer Hs2
Apr 29, 2026
Dec 15, 2011
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to access arbitrary files via unspecified vectors.
CVE-2011-4832
1Caupo
2Cauposhop Classic
Cauposhop Pro
Apr 29, 2026
Dec 15, 2011
N/A· v4
N/A· v3
7.5 HIGH· v2
Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter in a templat...Show more
Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter in a template action.Show less
CVE-2011-4831
1David Azoulay
1Web File Browser
Apr 29, 2026
Dec 15, 2011
N/A· v4
N/A· v3
4.0 MEDIUM· v2
Directory traversal vulnerability in webFileBrowser.php in Web File Browser 0.4b14 allows remote authenticated users to read arbitrary files via a ..%2f (encoded dot dot) in the file parameter in a download action.
CVE-2011-4813
1Whmcs
1Whmcompletesolution
Apr 29, 2026
Dec 14, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in clientarea.php in WHMCompleteSolution (WHMCS) 3.x.x allows remote attackers to read arbitrary files via an invalid action and a ../ (dot dot slash) in the templatefile parameter.
CVE-2011-4810
1Whmcs
1Whmcompletesolution
Apr 29, 2026
Dec 14, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Multiple directory traversal vulnerabilities in WHMCompleteSolution (WHMCS) 3.x and 4.x allow remote attackers to read arbitrary files via the templatefile parameter to (1) submitticket.php and (2) downloads.php, and (3)...Show more
Multiple directory traversal vulnerabilities in WHMCompleteSolution (WHMCS) 3.x and 4.x allow remote attackers to read arbitrary files via the templatefile parameter to (1) submitticket.php and (2) downloads.php, and (3) the report parameter to admin/reports.php.Show less
CVE-2011-4807
1Phpalbum
1Phpalbum
Apr 29, 2026
Dec 14, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in main.php in phpAlbum 0.4.1.16 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the var1 parameter.
CVE-2011-4804
1Foobla
1Com Obsuggest
Apr 29, 2026
Dec 14, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVE-2011-4800
1Solarwinds
1Serv U File Server
Apr 29, 2026
Dec 14, 2011
N/A· v4
N/A· v3
9.0 HIGH· v2
Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" (dot dot colon forward s...Show more
Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" (dot dot colon forward slash) in the (1) list, (2) put, or (3) get commands.Show less
CVE-2011-4716
1Dream Multimedia Tv
4Dreambox Dm800 Hd Pvr
Dreambox Dm800 Hd Pvr FirmwareDreambox Dm800 Hd Se+1 more
Apr 29, 2026
Dec 8, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file parameter.
CVE-2011-4715
1Koha
2Koha
Liblime Koha
Apr 29, 2026
Dec 8, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the Koha...Show more
Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm.Show less
CVE-2011-4714
1Vvertex
1Muster
Apr 29, 2026
Dec 8, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in Virtual Vertex Muster before 6.20 allows remote attackers to read arbitrary files via a \.. (backslash dot dot) in the URL.
CVE-2011-4713
1Oscss
1Oscss
Apr 29, 2026
Dec 8, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the _ID parameter to (1) catalog/shopping_cart.php or (2) catalog...Show more
Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the _ID parameter to (1) catalog/shopping_cart.php or (2) catalog/content.php.Show less
CVE-2011-4712
1Monoxide0184
1Oxide Webserver
Apr 29, 2026
Dec 8, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in Oxide WebServer allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in an HTTP request.
CVE-2011-4711
1Namazu
1Namazu
Apr 29, 2026
Dec 8, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Multiple directory traversal vulnerabilities in namazu.cgi in Namazu before 2.0.16 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) lang or (2) result parameter.
CVE-2011-2653
1Novell
1Zenworks Asset Management
Apr 29, 2026
Dec 8, 2011
N/A· v4
N/A· v3
10.0 HIGH· v2
Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by uploading an executable file.
CVE-2011-4675
1Widelands
1Widelands
Apr 29, 2026
Dec 5, 2011
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The pathname canonicalization functionality in io/filesystem/filesystem.cc in Widelands before 15.1 expands leading ~ (tilde) characters to home-directory pathnames but does not restrict use of these characters in string...Show more
The pathname canonicalization functionality in io/filesystem/filesystem.cc in Widelands before 15.1 expands leading ~ (tilde) characters to home-directory pathnames but does not restrict use of these characters in strings received from the network, which might allow remote attackers to conduct absolute path traversal attacks and overwrite arbitrary files via a ~ in a pathname that is used for a file transfer in an Internet game, a different vulnerability than CVE-2011-1932.Show less