Weakness (CWE)
CWE-35: Path Traversal: '.../...//'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, the ".../...//" manipulation is useful for bypassing some path traversal protection schemes. If "../" sequences are removed from the ".../...//" string in a sequential fashion (as some regular expression engines and other algorithms operate) the string can collapse into the unsafe "../" value (CWE-182). Removing the first "../" yields "....//" and the second removal yields "../".
-
Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Source: MITRE CWE-35
198 results · Feed
-
High 7.5
WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability
Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
-
High 8.1
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM…
-
Critical 9.1
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow a…
-
Medium 6.8
A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, I…
-
High 7.1
Path Traversal in Satel Iberia SenNet Datalogger Serie 200
Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server…
-
Low 3.8
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.
-
Low 3.8
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended da…
-
Critical 9.8
Path traversal may allow arbitrary files to be viewed, created, modified, or deleted
Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0.
-
High 7.5
WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
-
High 7.5
Path Traversal in /index.php/view_uploaded_iodd_file
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.
-
Medium 6.5
WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
-
Medium 6.8
Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with syst…
-
High 8.8
Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system …
-
Medium 4.4
In Audio HAL, there is a possible information disclosure due to improper input validation. This could lead to local inf…
-
Low 3.3
Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with …
-
High 7.1
Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with …
-
High 7.5
WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability
Subscriber Path Traversal in Do Lasso <= 358 versions.
-
High 7.5
A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is …
-
Critical 9.1
Path Traversal: '.../...//' in Crafty Controller
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
-
Critical 9.9
Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
-
Medium 6.5
WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability
Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.
-
Medium 4.8
Path traversal Vulnerability
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users.
-
High 7.8
An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.
-
Medium 6.5
WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability
Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for WooCommerce: from n/a before 1.9.5.
-
Critical —
motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal
# Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal ### Summary Myself and others have reported several RCE vulnerabilities to this project. However, due to the nature of the app, these are largely not of all that much v…
-
High 8.1
WordPress Kastell theme <= 2.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.
-
Critical 9.6
WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability
Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.
-
High 7.5
WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability
Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.
-
High 8.8
WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability
Custom role Path Traversal in WP Customer Area <= 8.3.4 versions.
-
Critical 9.0
Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included f…
-
Medium 4.2
Path Traversal Vulnerability in SAP Fiori (launchpad)
SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to posses…
-
Critical 9.9
Dokploy: Remote Code Execution through Path Traversal
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. W…
-
High 7.8
Path Traversal in Plugin Loading in libzypp
`PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host b…
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
-
Critical 9.1
CVE-2026-7302
SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to …
-
Medium 6.8
Appliance mode iControl REST vulnerability
When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files. Note: Software vers…
-
High 8.7
Appliance mode iControl REST vulnerability
When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
High 8.4
Rancher Extensions have arbitrary file access via path traversal
A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside…
-
Medium 6.7
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to pot…
-
High 7.8
Heimdall: Authorization bypass via path normalization mismatch
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 39…