Path Traversal: '.../...//'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

CVEs (172)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-26351 1Q Free 1Maxtime Jun 17, 2026 Feb 12, 2025 N/A· v4 4.9 MEDIUM· v3 N/A· v2 A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVE-2025-24786 1Clidey 1Whodb Jun 17, 2026 Feb 6, 2025 N/A· v4 9.1 CRITICAL· v3 N/A· v2 WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attac...Show more WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Affected versions of WhoDB allow users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled). If no databases are present in the default directory, the UI indicates that the user is unable to open any databases. The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.Show less
CVE-2025-0858 - - Jun 17, 2026 Feb 5, 2025 5.8 MEDIUM· v4 N/A· v3 N/A· v2 A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in certain Poly devices. The firmware flaw does not properly prevent path traversal and could lead to information disclosure.
CVE-2025-22205 1Admiror Design Studio 1Admiror Gallery Jul 5, 2026 Feb 4, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.
CVE-2025-24685 - - Jun 17, 2026 Jan 27, 2025 N/A· v4 8.1 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue affects Morkva UA Shipping: from n/a through <= 1.0.18.
CVE-2025-22786 1Elementinvader 1Elementinvader Addons For Elementor Jun 17, 2026 Jan 15, 2025 N/A· v4 8.8 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Inclusion.This issue affects ElementInvader Addons for Elementor:...Show more Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Inclusion.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.2.6.Show less
CVE-2024-49249 - - Jun 17, 2026 Jan 7, 2025 N/A· v4 8.6 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through <= 2.3.
CVE-2024-56045 1Vibethemes 1Wordpress Learning Management System Jun 17, 2026 Dec 31, 2024 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.
CVE-2024-56214 - - Jun 17, 2026 Dec 31, 2024 N/A· v4 8.3 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro userpro allows Path Traversal.This issue affects Userpro: from n/a through <= 5.1.9.
CVE-2024-56213 1Themewinter 1Eventin Jun 17, 2026 Dec 31, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7.
CVE-2023-7263 - - Jun 17, 2026 Dec 28, 2024 N/A· v4 7.3 HIGH· v3 N/A· v2 Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthorized file deletion or file permission change.(Vulnerability ID:HWPSIRT-2023-5345...Show more Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthorized file deletion or file permission change.(Vulnerability ID:HWPSIRT-2023-53450) This vulnerability has been assigned a (CVE)ID:CVE-2023-7263Show less
CVE-2023-7300 - - Jun 17, 2026 Dec 26, 2024 N/A· v4 8.0 HIGH· v3 N/A· v2 Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to be deleted or the file permission to be changed.(Vulnerability ID:HWPSIRT-2023-6...Show more Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to be deleted or the file permission to be changed.(Vulnerability ID:HWPSIRT-2023-60613)Show less
CVE-2024-56055 1Vibethemes 1Wordpress Learning Management System Jun 17, 2026 Dec 18, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
CVE-2024-56049 1Vibethemes 1Wordpress Learning Management System Jun 17, 2026 Dec 18, 2024 N/A· v4 8.5 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
CVE-2024-54313 - - Jun 17, 2026 Dec 13, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Path Traversal vulnerability in FULL. FULL Customer allows Path Traversal.This issue affects FULL Customer: from n/a through 3.1.25.
CVE-2024-21575 - - Jun 17, 2026 Dec 12, 2024 9.2 CRITICAL· v4 8.6 HIGH· v3 N/A· v2 ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This...Show more ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE).Show less
CVE-2024-54216 1Reputeinfosystems 1Arforms Jul 7, 2026 Dec 6, 2024 N/A· v4 7.7 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.
CVE-2024-52498 - - Jun 17, 2026 Nov 28, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows PHP Local File Inclusion.This issue affects SP Blog Designer: from n/a through <= 1.0.0.
CVE-2024-10857 1Tychesoftwares 1Product Input Fields For Woocommerce Jun 17, 2026 Nov 26, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sa...Show more The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.Show less
CVE-2024-50054 - - Jun 17, 2026 Nov 22, 2024 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and retrieve arbitrary files from the file system.

Previous 1...567 8 9 Next