Weakness (CWE)
CWE-36: Absolute Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
How to prevent it (3 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
-
Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-36
153 results · Feed
-
Critical 9.9
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
-
Medium 6.8
Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a ma…
-
Medium 6.1
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files o…
-
Medium 4.7
CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or…
-
High 8.1
Skype for Business Elevation of Privilege Vulnerability
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Skype for Business Remote Code Execution Vulnerability
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
-
Medium 6.5
Windows Encrypting File System (EFS) Information Disclosure Vulnerability
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.
-
High 8.8
Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
-
High 8.4
uniget: Path Traversal in Hook Files - Directory Escape Vulnerability
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that …
-
Low 3.5
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.
-
Critical 9.1
WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon o…
-
High 8.8
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
-
Critical 9.9
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
-
Medium 6.5
GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink Creation
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
-
High 7.8
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Error Reporting Elevation of Privilege Vulnerability
Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
-
Medium 5.5CVE-2026-47630 Public exploit
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traver…
-
Medium 6.5
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traver…
-
High 8.4
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate,…
-
Critical 9.2
Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In…
-
High 8.5
TeamDavid: Path Traversal in the archive creation functionality
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse director…
-
High 7.5
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoi…
-
Medium 5.6
pip absolute path traversal during download from malicious package indexes
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index…
-
High 7.5
SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.
-
Medium 6.5
RabbitMQ: UNC SSRF affecting the management UI on Windows
RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multipl…
-
Medium 5.3
ARMember <= 4.0.27 - Directory Traversal via X-FILENAME
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to dir…
-
Medium 6.2
Microsoft Edge for Android Information Disclosure Vulnerability
Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
-
High 7.6
Slopsmith has path traversal in archive extractors that allows arbitrary file write → potential RCE
Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal vulnerability in Slopsmith's archive extractors allows an attacker to write arbitrary files outside …
-
Medium 6.5
Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set
Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.
-
Medium 5.3
Interinfo｜DreamMaker - Path Traversal
DreamMaker developed by Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to read file names under arbitrary path by exploiting an Absolute Path Traversal vulnerability.
-
High 7.5
ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/
Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{filename} endpoint on Windows deployments that allows unauthenticated remote attackers to read arbitrary files by supplying absolute Windows pa…
-
High 8.6
A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-bas…
-
Medium 6.5CVE-2026-4782 Public exploit
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it pos…
-
Medium 4.3
.NET Core Tampering Vulnerability
A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker…
-
High 8.1
pyLoad: Path Traversal via Package Folder Name in set_package_data
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user wi…
-
Medium 4.6
PaperCut NG/MF: Path Traversal in Shared Account Synchronization
An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanit…
-
Medium 5.3
An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "…
-
Medium 5.3
Deepractice PromptX Document File index.ts read_pdf absolute path traversal
A security vulnerability has been detected in Deepractice PromptX up to 2.4.0. The affected element is the function read_docx/read_xlsx/read_pptx/list_xlsx_sheets/read_pdf of the file packages/mcp-office/src/index.ts of the component Document File Handler. Su…
-
High 7.5
SecureDrop Client has path injection in read_gzip_header_filename()
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual mach…
-
Medium 6.6
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.