← Back
CWE-35

172 CVEs • Abstraction: Variant

Path Traversal: '.../...//'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

JSON object

Loading...

CVEs (172)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-52805
-
-
Jun 17, 2026
Jul 4, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in VaultDweller Leyka leyka allows PHP Local File Inclusion.This issue affects Leyka: from n/a through <= 3.32.1.
CVE-2025-52811
-
-
Jun 17, 2026
Jun 27, 2025
N/A· v4
8.1 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme davenport allows PHP Local File Inclusion.This issue affects Davenport - Versatile Blog and Magazine WordPress...Show more
Path Traversal: '.../...//' vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme davenport allows PHP Local File Inclusion.This issue affects Davenport - Versatile Blog and Magazine WordPress Theme: from n/a through <= 1.3.Show less
CVE-2025-52810
-
-
Jun 17, 2026
Jun 27, 2025
N/A· v4
8.1 HIGH· v3
N/A· v2
Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.
CVE-2025-49451
-
-
Jun 17, 2026
Jun 17, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – I...Show more
Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: from n/a through <= 1.0.13.Show less
CVE-2025-47176
1Microsoft
2365 Apps
Office Long Term Servicing Channel
Jun 17, 2026
Jun 10, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
CVE-2025-30515
1Cyberdata
1011209 Sip Emergency Intercom Firmware
Jun 17, 2026
Jun 9, 2025
9.3 CRITICAL· v4
8.8 HIGH· v3
N/A· v2
CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.
CVE-2025-49297
1Qodeinteractive
1Grill And Chow
Jun 17, 2026
Jun 9, 2025
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6.
CVE-2025-49296
1Qodeinteractive
1Grandprix
Jun 17, 2026
Jun 9, 2025
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <= 1.6.
CVE-2025-49295
1Qodeinteractive
1Mediclinic
Jun 17, 2026
Jun 9, 2025
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a through <= 2.1.
CVE-2025-39475
-
-
Jun 17, 2026
Jun 9, 2025
N/A· v4
8.1 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3.
CVE-2025-27445
-
-
Jun 17, 2026
Jun 5, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused...Show more
A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused by insufficient sanitization of user-supplied input in file path parameters, allowing attackers to exploit directory traversal sequences (e.g., ../) to access sensitive filesShow less
CVE-2025-5598
-
-
Jun 17, 2026
Jun 4, 2025
9.2 CRITICAL· v4
N/A· v3
N/A· v2
Path Traversal vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Retrieve Embedded Sensitive Data.This issue affects airleader MASTER: 3.0046.
CVE-2025-46441
-
-
Jun 17, 2026
May 19, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in ctltwp Section Widget section-widget allows Path Traversal.This issue affects Section Widget: from n/a through <= 3.3.1.
CVE-2025-27010
-
-
Jun 17, 2026
May 19, 2025
N/A· v4
8.1 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2.
CVE-2025-39492
-
-
Jun 17, 2026
May 16, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision.
CVE-2025-39491
-
-
Jun 17, 2026
May 16, 2025
N/A· v4
8.1 HIGH· v3
N/A· v2
Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.
CVE-2025-40573
1Siemens
1Scalance Lpe9403 Firmware
Jun 17, 2026
May 13, 2025
6.7 MEDIUM· v4
4.4 MEDIUM· v3
N/A· v2
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to path traversal attacks. This could allow a privileged local attacker to restore...Show more
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to path traversal attacks. This could allow a privileged local attacker to restore backups that are outside the backup folder.Show less
CVE-2025-47649
-
-
Jun 17, 2026
May 7, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.9.
CVE-2025-47636
-
-
Jun 17, 2026
May 7, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
Path Traversal: '.../...//' vulnerability in Fernando Briano List category posts list-category-posts allows PHP Local File Inclusion.This issue affects List category posts: from n/a through <= 0.91.0.
CVE-2025-32950
1Haulmont
1Jmix Framework
Jun 17, 2026
Apr 22, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the sy...Show more
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.Show less