Path Traversal: '.../...//'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

CVEs (172)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-39470 - - Jun 17, 2026 Apr 18, 2025 N/A· v4 8.1 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in ThimPress Ivy School ivy-school allows PHP Local File Inclusion.This issue affects Ivy School: from n/a through <= 1.6.0.
CVE-2025-24908 - - Jun 17, 2026 Apr 16, 2025 N/A· v4 6.8 MEDIUM· v3 N/A· v2 Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolv...Show more Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) Description Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service. Impact This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.Show less
CVE-2025-24907 - - Jun 17, 2026 Apr 16, 2025 N/A· v4 6.8 MEDIUM· v3 N/A· v2 Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolv...Show more Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) Description Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API. Impact This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.Show less
CVE-2025-39598 - - Jun 17, 2026 Apr 16, 2025 N/A· v4 4.9 MEDIUM· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in Quý Lê 91 Administrator Z administrator-z allows Path Traversal.This issue affects Administrator Z: from n/a through <= 2025.03.28.
CVE-2025-30966 - - Jun 17, 2026 Apr 15, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Path Traversal vulnerability in NotFound WPJobBoard allows Path Traversal. This issue affects WPJobBoard: from n/a through n/a.
CVE-2025-32585 - - Jun 17, 2026 Apr 11, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in Trusty Plugins Shop Products Filter trusty-woo-products-filter allows PHP Local File Inclusion.This issue affects Shop Products Filter: from n/a through <= 1.2.
CVE-2025-30014 - - Jun 17, 2026 Apr 8, 2025 N/A· v4 7.7 HIGH· v3 N/A· v2 SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, h...Show more SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, hence causing a high impact on confidentiality. Integrity and Availability are not affected.Show less
CVE-2025-30834 - - Jun 17, 2026 Apr 1, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in Bit Apps Bit Assist bit-assist allows Path Traversal.This issue affects Bit Assist: from n/a through <= 1.5.4.
CVE-2024-54362 - - Jun 17, 2026 Mar 28, 2025 N/A· v4 8.1 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in boggibill GetShop ecommerce getshop-ecommerce allows Path Traversal.This issue affects GetShop ecommerce: from n/a through <= 1.3.
CVE-2025-26940 - - Jun 17, 2026 Mar 15, 2025 N/A· v4 6.3 MEDIUM· v3 N/A· v2 Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
CVE-2025-27274 1Axelkeller 1Gpx Viewer Jun 17, 2026 Mar 3, 2025 N/A· v4 4.9 MEDIUM· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in axelkeller GPX Viewer gpx-viewer allows Path Traversal.This issue affects GPX Viewer: from n/a through <= 2.2.11.
CVE-2025-25122 - - Jun 17, 2026 Mar 3, 2025 N/A· v4 8.1 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through <= 3.0.2.
CVE-2025-26935 1Wpjobportal 1Wp Job Portal Jun 17, 2026 Feb 25, 2025 N/A· v4 8.8 HIGH· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in wpjobportal WP Job Portal wp-job-portal allows PHP Local File Inclusion.This issue affects WP Job Portal: from n/a through <= 2.2.8.
CVE-2025-26876 1Codemanas 1Search With Typesense Jun 17, 2026 Feb 25, 2025 N/A· v4 4.9 MEDIUM· v3 N/A· v2 Path Traversal: '.../...//' vulnerability in CodeManas Search with Typesense search-with-typesense allows Path Traversal.This issue affects Search with Typesense: from n/a through <= 2.0.8.
CVE-2025-26357 1Q Free 1Maxtime Jun 17, 2026 Feb 12, 2025 N/A· v4 4.9 MEDIUM· v3 N/A· v2 A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVE-2025-26356 1Q Free 1Maxtime Jun 17, 2026 Feb 12, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted...Show more A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.Show less
CVE-2025-26355 1Q Free 1Maxtime Jun 17, 2026 Feb 12, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
CVE-2025-26354 1Q Free 1Maxtime Jun 17, 2026 Feb 12, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP...Show more A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.Show less
CVE-2025-26353 1Q Free 1Maxtime Jun 17, 2026 Feb 12, 2025 N/A· v4 4.9 MEDIUM· v3 N/A· v2 A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVE-2025-26352 1Q Free 1Maxtime Jun 17, 2026 Feb 12, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.

Previous 1...456...9 Next