← Back
CWE-35

181 CVEs • Abstraction: Variant

Path Traversal: '.../...//'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

JSON object

Loading...

CVEs (181)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-25122
-
-
Jun 17, 2026
Mar 3, 2025
N/A· v4
8.1 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through <= 3.0.2.
CVE-2025-26935
1Wpjobportal
1Wp Job Portal
Jun 17, 2026
Feb 25, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in wpjobportal WP Job Portal wp-job-portal allows PHP Local File Inclusion.This issue affects WP Job Portal: from n/a through <= 2.2.8.
CVE-2025-26876
1Codemanas
1Search With Typesense
Jun 17, 2026
Feb 25, 2025
N/A· v4
4.9 MEDIUM· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in CodeManas Search with Typesense search-with-typesense allows Path Traversal.This issue affects Search with Typesense: from n/a through <= 2.0.8.
CVE-2025-26357
1Q Free
1Maxtime
Jun 17, 2026
Feb 12, 2025
N/A· v4
4.9 MEDIUM· v3
N/A· v2
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVE-2025-26356
1Q Free
1Maxtime
Jun 17, 2026
Feb 12, 2025
N/A· v4
7.2 HIGH· v3
N/A· v2
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted...Show more
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.Show less
CVE-2025-26355
1Q Free
1Maxtime
Jun 17, 2026
Feb 12, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
CVE-2025-26354
1Q Free
1Maxtime
Jun 17, 2026
Feb 12, 2025
N/A· v4
7.2 HIGH· v3
N/A· v2
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP...Show more
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.Show less
CVE-2025-26353
1Q Free
1Maxtime
Jun 17, 2026
Feb 12, 2025
N/A· v4
4.9 MEDIUM· v3
N/A· v2
A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVE-2025-26352
1Q Free
1Maxtime
Jun 17, 2026
Feb 12, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
CVE-2025-26351
1Q Free
1Maxtime
Jun 17, 2026
Feb 12, 2025
N/A· v4
4.9 MEDIUM· v3
N/A· v2
A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVE-2025-24786
1Clidey
1Whodb
Jun 17, 2026
Feb 6, 2025
N/A· v4
9.1 CRITICAL· v3
N/A· v2
WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attac...Show more
WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Affected versions of WhoDB allow users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled). If no databases are present in the default directory, the UI indicates that the user is unable to open any databases. The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.Show less
CVE-2025-0858
-
-
Jun 17, 2026
Feb 5, 2025
5.8 MEDIUM· v4
N/A· v3
N/A· v2
A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in certain Poly devices. The firmware flaw does not properly prevent path traversal and could lead to information disclosure.
CVE-2025-22205
1Admiror Design Studio
1Admiror Gallery
Jul 5, 2026
Feb 4, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.
CVE-2025-24685
-
-
Jun 17, 2026
Jan 27, 2025
N/A· v4
8.1 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue affects Morkva UA Shipping: from n/a through <= 1.0.18.
CVE-2025-22786
1Elementinvader
1Elementinvader Addons For Elementor
Jun 17, 2026
Jan 15, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Inclusion.This issue affects ElementInvader Addons for Elementor:...Show more
Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Inclusion.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.2.6.Show less
CVE-2024-49249
-
-
Jun 17, 2026
Jan 7, 2025
N/A· v4
8.6 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through <= 2.3.
CVE-2024-56045
1Vibethemes
1Wordpress Learning Management System
Jun 17, 2026
Dec 31, 2024
N/A· v4
9.3 CRITICAL· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.
CVE-2024-56214
-
-
Jun 17, 2026
Dec 31, 2024
N/A· v4
8.3 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro userpro allows Path Traversal.This issue affects Userpro: from n/a through <= 5.1.9.
CVE-2024-56213
1Themewinter
1Eventin
Jun 17, 2026
Dec 31, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7.
CVE-2023-7263
-
-
Jun 17, 2026
Dec 28, 2024
N/A· v4
7.3 HIGH· v3
N/A· v2
Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthorized file deletion or file permission change.(Vulnerability ID:HWPSIRT-2023-5345...Show more
Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthorized file deletion or file permission change.(Vulnerability ID:HWPSIRT-2023-53450) This vulnerability has been assigned a (CVE)ID:CVE-2023-7263Show less