Path Traversal
Monthly
Path traversal in Fujian Apex LiveBOS through the /feed/UploadImage.do endpoint allows remote attackers to manipulate the filename parameter and write files to arbitrary locations on the server. Versions up to 2.0 are affected. Public exploit code is available. Upgrading to version 2.1 resolves the vulnerability.
Path traversal in IBM Langflow Desktop versions 1.8.4 and earlier allows authenticated remote attackers to read arbitrary files on the system by crafting URLs containing directory traversal sequences (/../). The vulnerability affects the file handling mechanism and could expose sensitive configuration, source code, or other confidential files accessible to the Langflow process. A vendor-released patch is available.
Authenticated attackers can exploit a path traversal vulnerability in IBM Langflow Desktop 1.2.0 through 1.8.4 to write arbitrary files to the system by crafting URLs containing directory traversal sequences (/../). The vulnerability requires prior authentication but allows complete bypass of file system restrictions, enabling file overwrite or creation outside intended directories with no integrity protections.
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Path traversal in ZMCPTools up to version 0.2.2 allows authenticated remote attackers to read or manipulate files outside intended directories via the dirname argument in the MCP Log Resource Handler component. The vulnerability is exploitable over the network by authenticated users with low privileges, has publicly available exploit code, and carries a CVSS score of 2.1 reflecting low confidentiality and integrity impact with no scope expansion.
Path traversal in Admidio's document add mode allows authenticated attackers to register arbitrary server files into document folders via unvalidated `name` parameter, enabling arbitrary file read when combined with CSRF. A low-privileged user can trick a documents administrator into clicking a malicious link to register sensitive files like `install/config.php` (containing database credentials) into a publicly accessible documents folder, then download those files using the attacker's own session. The vulnerability chains insufficient input validation (accepts `../` sequences), missing CSRF protection on the `add` action, and `SameSite=Lax` cookies that permit cross-site GET requests from administrators.
Path traversal in Admidio ecard_preview.php allows authenticated users to read arbitrary server files including database credentials by bypassing filename validation on the ecard_template POST parameter. An authenticated attacker can supply path traversal payloads such as ../config.php to read adm_my_files/config.php containing unencrypted database host, username, and password, or traverse further to access system files. Exploitation requires only a regular member account with no special privileges, making this a high-impact vulnerability accessible to any registered user.
Path traversal in mcpo-simple-server 0.2.0 and earlier enables unauthenticated remote attackers to delete arbitrary files via the delete_shared_prompt function. The vulnerability affects the prompt_manager module's base_manager.py file, where improper validation of the 'detail' parameter allows directory traversal sequences. A public proof-of-concept exploit exists (GitHub issue #4), making this an immediate threat to internet-exposed instances. EPSS data not available, but the combination of network exploitability (AV:N), no authentication required (PR:N), and public POC significantly elevates real-world risk despite moderate CVSS 7.3 score. Vendor has not responded to early disclosure.
Path traversal in geldata gel-mcp 0.1.0 allows remote unauthenticated attackers to read arbitrary files via manipulation of the rule_name argument in the list_rules and fetch_rule functions. The vulnerability has a CVSS score of 5.3 (Low confidentiality impact) with network accessibility and no authentication requirements. Public exploit code exists and the vendor has not responded to early disclosure.
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows authenticated attackers to disclose arbitrary files by injecting path traversal. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LifeSize ClearSea 3.1.4 contains directory traversal vulnerabilities that allow authenticated attackers to download and upload arbitrary files by manipulating path parameters in the smartgui. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in geekgod382 filesystem-mcp-server 1.0.0 allows unauthenticated remote attackers to read or write files outside the server's intended allowed directories by supplying path sequences that bypass the flawed `is_path_allowed()` check in `server.py`. Both `read_file_tool` and `write_file_tool` are affected, enabling arbitrary file exfiltration or overwrite on the host. A public exploit POC exists on GitHub; SSVC rates this as automatable with partial technical impact, though EPSS at 0.05% (16th percentile) reflects the product's niche deployment footprint rather than low exploitability. No CISA KEV listing. Vendor-released patch v1.1.0 is available.
Path traversal in BioinfoMCP's Upload Endpoint allows remote unauthenticated attackers to read or write files outside the intended directory by manipulating the Name argument in the Upload function (bioinfo_mcp_platform/app.py). The affected product is florensiawidjaja's BioinfoMCP at or before commit 7ada7918b9e515604d3c0ae264d3a9af10bf6e54, a bioinformatics platform using continuous rolling releases. A public exploit exists via GitHub issue report, and SSVC classifies the attack as automatable with partial technical impact; however, EPSS remains very low at 0.05% (14th percentile), consistent with an obscure research tool rather than widespread enterprise software. No vendor patch or response has been issued as of the time of this analysis.
Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attackers through the WeChat Work (WeCom) platform adapter component. The vulnerability resides in gateway/platforms/wecom.py and is limited to confidentiality impact (VC:L), with no integrity or availability consequence. A public proof-of-concept exists per GitHub issue reference, though EPSS of 0.05% (15th percentile) and SSVC's 'Automatable: no' designation indicate constrained real-world exploitation risk; no CISA KEV listing has been confirmed.
Path traversal in SonicWall SonicOS enables authenticated attackers on adjacent networks to access services that are normally restricted to privileged system internals. Affecting multiple SonicOS branches (6.x, 7.0.x, 7.3.x, 8.x), successful exploitation can result in high availability impact alongside limited confidentiality and integrity gains, per the CVSS impact metrics. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, with EPSS at 0.01% (2nd percentile), indicating negligible in-the-wild exploitation pressure at time of analysis.
Path traversal in fatbobman mail-mcp-bridge versions 1.3.0 through 1.3.3 exposes arbitrary filesystem paths to remote unauthenticated attackers via unsanitized `message_ids` arguments in the MCP server's attachment management functions. The vulnerable code in `cleanup_attachments.py` and `extract_attachments.py` directly concatenated email Message-ID values onto a base filesystem path without validation, allowing sequences such as `../../etc` to escape the intended attachment directory. A public exploit exists (GitHub issue #2), SSVC rates the attack as automatable, and vendor-released fix version 1.3.4 is available.
Path traversal in ezequiroga/mcp-bases `search_papers` function allows unauthenticated remote attackers to read and potentially write files outside the intended directory by supplying crafted `../` sequences in the `topic` argument to research_server.py. Two specific commits (357ca19 and c630b8a) are confirmed affected; the project's rolling release model means no versioned fix exists and the maintainer had not responded to disclosure at time of reporting. A public proof-of-concept exploit is available via GitHub, and SSVC rates exploitation as automatable with partial technical impact - a notable combination despite the low EPSS of 0.05%.
Cockpit CMS versions 2.13.5 and earlier allow authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets via directory traversal in the Buckets component. The vulnerability requires valid user authentication and does not impact confidentiality, but enables integrity compromise through malicious file placement or asset replacement. A proof-of-concept exists, though the SSVC framework rates automatable exploitation as unlikely, suggesting manual attack steps are required.
Path traversal in elinsky's execution-system-mcp 0.1.0 allows remote unauthenticated attackers to escape the intended directory boundary by manipulating the `context` argument passed to the `_get_context_file_path` function via the `add_action` tool, enabling read and potential write access to arbitrary files on the host filesystem. A public proof-of-concept exploit is confirmed (GitHub issue #1, VulDB 359972), and SSVC classifies the attack as automatable with partial technical impact. Despite EPSS at 0.08% reflecting the product's obscurity, the no-auth network-exploitable attack surface means any exposed instance faces meaningful risk.
Path traversal in elie's mcp-project 0.1.0 exposes local filesystem paths through the `search_papers` function in `research_server.py`, where the unsanitized `topic` argument can be manipulated to traverse directory boundaries. The vulnerability produces partial confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L) and is confined to local attack scenarios. A public proof-of-concept exists per SSVC and VulDB reporting, though EPSS places exploitation probability at 0.02% (4th percentile) and SSVC confirms the attack is not automatable - indicating low real-world threat despite POC availability.
Path traversal in eiceblue spire-pdf-mcp-server 0.1.1 allows unauthenticated remote attackers to escape the intended PDF directory by supplying crafted traversal sequences in the filepath argument to the get_pdf_path function, enabling unauthorized read and write access to arbitrary files on the host. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions, and a published exploit is confirmed (E:P). No vendor patch is available; the project maintainer has not responded to the responsible disclosure filed in GitHub issue #1.
Path traversal in eiceblue spire-doc-mcp-server 1.0.0 allows remote unauthenticated attackers to escape the intended document directory by supplying crafted sequences in the `document_name` argument to the `get_doc_path` function in `src/spire_doc_mcp/api/base.py`. A public exploit exists and SSVC confirms the attack is automatable with partial technical impact across confidentiality, integrity, and availability. No vendor patch is available - the project has not responded to the coordinated disclosure filed via GitHub issue.
Filesystem policy bypass in OpenClaw's Feishu docx upload pipeline (upload_file and upload_image endpoints) enables authenticated users to read local files outside the intended workspace-only boundary via path traversal. All npm versions of openclaw prior to 2026.4.8 are affected; this is explicitly an incomplete fix of a prior advisory (GHSA-qf48-qfv4-jjm9), indicating the original control was partially circumvented. No active exploitation has been identified - SSVC rates exploitation as none, EPSS sits at 0.04% (12th percentile), and the vulnerability is absent from CISA KEV - with a vendor-confirmed patch available at version 2026.4.8.
OpenClaw before version 2026.4.2 allows authenticated attackers to delete arbitrary remote directories during mirror mode synchronization operations by manipulating remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. An attacker with login credentials can craft malicious OpenShell config paths that cause the mirror sync function to delete unintended remote directory contents before replacing them with uploaded workspace data, resulting in data loss and potential service disruption.
Path traversal in DV0x creative-ad-agent server component (up to commit 751b9e5146604dc65049bd0f62dcbdad6212f8a3) allows remote unauthenticated attackers to read arbitrary files via manipulation of req.params arguments in server/sdk-server.ts. Public exploit code is available. CVSS 5.5 reflects low confidentiality impact with network-accessible attack vector and no authentication requirement.
Path traversal in WilliamCloudQi matlab-mcp-server allows remote unauthenticated attackers to manipulate the scriptPath argument in the generate_matlab_code and execute_matlab_code functions, enabling unauthorized file system access with confidentiality and integrity impact. The vulnerability affects versions up to commit ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca, has publicly available exploit code, and the vendor has not yet responded to early disclosure notification.
Path traversal in AgiFlow scaffold-mcp's write-to-file tool allows remote unauthenticated attackers to read, write, or delete arbitrary files on the server by manipulating the file_path parameter. Versions up to 1.0.27 are affected. Public exploit code exists (GitHub issue #88), enabling attackers to bypass directory restrictions and access sensitive files or overwrite critical system files. CVSS 7.3 (High) with network attack vector and no authentication required. Vendor-released patch available in version 1.1.0 (commit c4d23592).
Path traversal vulnerability in ErlichLiu claude-agent-sdk-master allows remote unauthenticated attackers to read arbitrary files by manipulating the outputFile parameter in app/api/agent-output/route.ts. The vulnerability has a CVSS score of 5.3 (low integrity impact) and publicly available exploit code exists, though the project uses rolling releases and the maintainer has not yet responded to disclosure.
Path traversal in browser-operator-core versions up to 0.6.0 allows remote unauthenticated attackers to read, write, and potentially delete arbitrary files on the server by manipulating the request.url parameter in the startsWith function of server.js. Publicly available exploit code exists (GitHub issue #96), enabling trivial exploitation with no user interaction. CVSS 7.3 reflects network-exploitable attack with low impact across confidentiality, integrity, and availability. No vendor response or patch released despite early responsible disclosure via issue report. This is a critical supply chain risk for any systems running the affected BrowserOperator component server.
Absolute path traversal in Deepractice PromptX up to version 2.4.0 allows remote unauthenticated attackers to read arbitrary files from the server by manipulating the path argument in document file handling functions (read_docx, read_xlsx, read_pptx, list_xlsx_sheets, read_pdf). Publicly available exploit code exists and the vendor has not responded to early disclosure, though CVSS 5.3 (AV:N/AC:L/PR:N/UI:N) indicates moderate information disclosure risk with no integrity or availability impact.
Path traversal in processing-claude-mcp-bridge's create_sketch tool allows remote unauthenticated attackers to read, write, or delete arbitrary files on the server by manipulating the sketch_name parameter in processing_server.py. Public exploit code exists via GitHub issue #1, enabling straightforward attacks against exposed instances. EPSS data not available, but CVSS 7.3 (High) with network vector and no authentication requirements indicates significant risk for internet-facing deployments. Project maintainer has not responded to vulnerability disclosure, leaving no vendor-confirmed patch timeline.
Path traversal in eghuzefa engineer-your-data up to version 0.1.3 allows remote attackers to read, write, list, and obtain information about arbitrary files via manipulation of the WORKSPACE_PATH argument in the read_file, write_file, list_files, and file_inf functions within src/server.py. Publicly available exploit code exists, and the vendor has been notified but has not yet responded with a fix.
Path traversal in ef10007 MLOps_MCP 1.0.0 allows remote unauthenticated attackers to write files to arbitrary filesystem locations via manipulation of the filename/destination argument in the save_file tool of fastmcp_server.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification, leaving affected deployments without an official patch.
Path traversal in duartium papers-mcp-server allows remote unauthenticated attackers to access arbitrary files on the server by manipulating the topic argument in the search_papers function. The vulnerability affects commit 9ceb3812a6458ba7922ca24a7406f8807bc55598 and is publicly exploitable with proof-of-concept code available; the vendor has been notified via issue report but has not yet responded.
Path traversal in edvardlindelof notes-mcp up to version 0.1.4 allows remote unauthenticated attackers to read or manipulate files outside the intended directory by manipulating the root_dir or path arguments in notes_mcp.py. The vulnerability has a publicly available exploit and a CVSS score of 6.9, but the vendor has not responded to the early disclosure through issue tracking.
OpenClaw versions 2026.2.6 through 2026.3.24 allow authenticated remote attackers to read arbitrary files outside configured sandbox boundaries via path traversal in the Feishu extension's resolveUploadInput function during upload_image operations. The vulnerability bypasses file-system sandbox restrictions through improper path resolution, enabling confidentiality compromise of sensitive data accessible to the application process.
Path traversal in OSPG binwalk 2.4.3 and earlier allows local low-privileged attackers to read or write files outside the intended extraction directory by supplying a crafted WinCE firmware image that manipulates the `self.file_name` argument in the `read_null_terminated_string` function of the WinCE Extraction Plugin. A public proof-of-concept exploit exists, though EPSS sits at 0.01% (2nd percentile) and CISA KEV lists no confirmed active exploitation, indicating negligible real-world uptake. The project maintainer has acknowledged the flaw but confirmed no patch will be released, as binwalk 2.x is end-of-life; migration to binwalk v3 is the only vendor-endorsed resolution.
Path traversal in CPython's `shutil.unpack_archive()` on Windows allows arbitrary file writes outside the intended extraction directory when processing ZIP archives containing Windows drive-letter absolute paths (e.g., `C:\...`, `D:\...`). The existing sanitization in `_unpack_zipfile()` rejected only Unix-style absolute paths (`/`) and directory traversal sequences (`..`), leaving Windows drive specifiers completely unchecked. No public exploit has been identified at time of analysis; EPSS of 0.05% (14th percentile) and SSVC exploitation status of 'none' indicate no observed exploitation, though the high integrity impact warrants patching in environments that process untrusted ZIP archives on Windows.
Path traversal in douinc mkdocs-mcp-plugin 0.4.0 and 0.4.1 exposes arbitrary server filesystem files to remote unauthenticated attackers via unsanitized docs_dir and file_path arguments in the read_document and list_documents functions of server.py. A public proof-of-concept is available on GitHub (issue #6), and SSVC classifies the attack as automatable, lowering the bar for mass exploitation. No patched version has been released at time of analysis; the vendor has acknowledged the issue and committed to publishing a fix within days.
Path traversal in kaggle-mcp's `prepare_kaggle_dataset` function exposes the host filesystem to remote unauthenticated attackers via unsanitized `competition_id` input. Any deployment of this Model Context Protocol server at commit 406127ff or earlier is affected across all platforms. A publicly disclosed exploit exists and SSVC confirms the attack is automatable, meaning attackers can read, write, or partially disrupt arbitrary server files without credentials or user interaction; the maintainer has not responded to the coordinated disclosure issue filed on GitHub.
Unauthenticated directory traversal in Pro-Bit versions before 1.77.4 exposes sensitive directories and subdirectories to remote attackers without authentication. The vulnerability allows direct access to protected file system locations via network requests, enabling unauthorized information disclosure. EPSS score of 0.02% (6th percentile) indicates low observed exploitation probability in the wild, and no CISA KEV listing exists at time of analysis, suggesting limited active exploitation despite the CVSS 7.5 severity rating.
Path traversal in the Blocks module of Daylight Studio FuelCMS v1.5.2 enables authenticated low-privileged users to read arbitrary server-side files outside the web root by injecting directory traversal sequences into the module's path parameter. A public proof-of-concept is confirmed via SSVC exploitation status and the pentest-tools advisory (PTT-2025-031), though no active exploitation appears in CISA KEV. With an EPSS of 0.06% (19th percentile) and a read-only, non-automatable attack profile, this represents a real but low-urgency confidentiality risk - file disclosure rather than code execution.
Path traversal in code-projects Online Lot Reservation System 1.0 allows unauthenticated remote attackers to read arbitrary files from the server by supplying directory traversal sequences in the unsanitized `File` parameter of `/download.php`. A public proof-of-concept exploit is available on GitHub, and SSVC classifies the attack as automatable with partial technical impact, though EPSS at 0.04% (13th percentile) indicates negligible observed exploitation activity to date. No CISA KEV listing exists, suggesting exploitation remains opportunistic rather than widespread.
Path traversal in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to access files outside intended directories via the url parameter in the downloadApp endpoint (src/routes/setting/about/downloadApp.ts). The vulnerability requires high attack complexity and authenticated access; vendor mitigation notes that the update URL is statically compiled in official code and exploitation would require users to modify source code. Publicly disclosed exploit code exists, but real-world exploitability is disputed by the vendor and remains uncertain.
Path traversal in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to read arbitrary files via manipulation of the url argument in the updateStoryboardUrl function of the Storyboard Export component. The vulnerability has a publicly available exploit, though the vendor disputes its practical exploitability, arguing the affected interface is designed to accept only local or trusted Docker-configured addresses. CVSS 4.3 reflects low confidence (RC:C) and unconfirmed exploitation probability (E:P).
Path traversal in MiroFish up to version 0.1.2 allows remote unauthenticated attackers to read arbitrary files via manipulation of the Platform query parameter in the get_simulation_posts function. The vulnerability affects the backend simulation API endpoint and has publicly available exploit code, though exploitation is limited to information disclosure rather than modification or availability impact.
Path traversal in Tenda i9 router firmware version 1.0.0.5(2204) allows remote unauthenticated attackers to access arbitrary files, modify system configurations, and potentially disrupt device operation via the R7WebsSecurityHandlerfunction in the HTTP Handler component. Publicly available exploit code exists on GitHub (Litengzheng/vuldb_new), enabling straightforward exploitation with EPSS-assessed risk. The vulnerability permits confidentiality, integrity, and availability impacts with low attack complexity and no required user interaction, making it a realistic target for automated scanning and exploitation.
Path traversal in rawchen sims DeleteFileServlet endpoint allows authenticated remote attackers to manipulate the filename parameter and access arbitrary files on the system, potentially leading to information disclosure or file modification. The vulnerability affects all versions up to commit 004f783b1db5ecdfad81c8fdc3b34171211112de, with publicly available exploit code and no vendor response to early disclosure notification.
Path traversal vulnerability in Ollama up to version 0.20.2 affects the digestToPath function in the Tensor Model Transfer Handler, allowing remote attackers with high complexity to manipulate digest arguments and traverse the filesystem. Public exploit code exists, though the vendor has not acknowledged disclosure attempts. CVSS 6.3 reflects low confidentiality, integrity, and availability impact limited by high attack complexity and no scope change.
FreeRDP versions prior to 3.25.0 allow path traversal attacks through an off-by-one error in the drive redirection filter, enabling rogue RDP servers to read, list, or write files one directory above the client's shared folder via RDPDR requests. Exploitation requires the victim to connect with drive redirection enabled and interact with a malicious RDP server, making this a user-interaction-dependent remote attack with moderate CVSS score (4.2) but real-world impact limited by connection and configuration requirements.
Path traversal in Chainguard melange's `--persist-lint-results` feature allows an attacker who controls the contents of a processed APK to write attacker-influenced JSON files to arbitrary filesystem locations reachable by the melange process. Affected versions span v0.32.0 through v0.43.3; the root cause is that `arch` and `pkgname` values from the APK's `.PKGINFO` control file were used unsanitized in output path construction. No direct code execution is possible, but the write primitive can clobber other JSON artifacts on the build host. No public exploit code exists and CISA KEV does not list this vulnerability.
Path traversal in Chainguard's melange build tool (versions >= 0.32.0, < 0.43.4) allows an attacker who can influence a melange configuration file to escape the designated pipeline directory via `../` sequences or absolute paths in `pipeline[].uses`, enabling both arbitrary file reads and shell command execution within the build sandbox. This is acutely dangerous in pull-request-driven CI or build-as-a-service scenarios where untrusted contributors can submit melange configs that are automatically built without review. No public exploit has been identified at time of analysis; EPSS of 0.01% and SSVC exploitation status 'none' confirm no observed active exploitation, but the impact of arbitrary shell execution during a trusted build pipeline makes this high-priority for affected CI deployments.
Path traversal in radare2's project notes handling exposes arbitrary filesystem files to read and overwrite when a user imports a crafted .zrp archive. All radare2 releases prior to 6.1.4 are vulnerable via the `r_core_project_notes_file()` function in `libr/core/project.c`, which failed to detect symlinks within imported project archives before performing note operations. An attacker who can deliver and persuade a victim to import a malicious .zrp file can escape the configured `dir.projects` directory entirely, gaining low confidentiality and high integrity impact on the host filesystem. No active exploitation is confirmed in CISA KEV, but a working proof-of-concept is publicly available in the referenced GitHub PR test suite.
Path traversal in radare2's project deletion function (r_core_project_delete in libr/core/project.c) allows a local attacker to cause recursive deletion of arbitrary directories by supplying crafted absolute project paths that escape the configured dir.projects root. All versions prior to 6.1.4 are affected. An attacker who controls a project file path can cause radare2 - running with the victim's permissions - to wipe arbitrary directories, resulting in significant integrity and availability impact. No public exploit identified at time of analysis for weaponized in-the-wild use; however, a publicly available exploit (POC) exists via the upstream GitHub PR, and SSVC rates technical impact as total despite non-automatable exploitation.
Arbitrary file write vulnerability in IBM Guardium Data Protection 12.1 allows authenticated administrative users to traverse directories and write files to arbitrary locations via specially crafted URLs containing path traversal sequences (/../). The vulnerability requires high-privilege admin credentials and network access but results in integrity compromise without requiring user interaction, making it a post-authentication privilege abuse risk for organizations running this data protection platform.
Path traversal in DDEV versions prior to 1.25.2 allows remote attackers to write files outside intended extraction directories when downloading and extracting archives from remote sources. The vulnerability affects the Untar() and Unzip() functions in pkg/archive/archive.go, which lack path validation during extraction. Exploitation requires user interaction (UI:R) to trigger archive extraction but can achieve high integrity impact through arbitrary file write. A proof-of-concept exists, and CISA SSVC framework rates this as exploitable with partial technical impact.
The rm utility in uutils coreutils fails to properly validate current directory paths with trailing slashes (./ or .///), allowing local users with write access to silently delete all contents of the current directory via rm -rf ./ while the utility reports a misleading 'Invalid input' error. CVSS score 5.6 reflects local attack vector and required user interaction, though the impact is severe data loss with potential recovery complications.
Time-of-Check to Time-of-Use (TOCTOU) symlink race condition vulnerability in uutils coreutils affects directory traversal operations on macOS and FreeBSD because the safe_traversal module's file-descriptor-relative syscall protections are incorrectly limited to Linux targets only. Local authenticated attackers with limited privileges can exploit this race condition to read or modify files via symlink manipulation, though exploitation requires specific timing conditions and is not automatable. EPSS and CISA SSVC assessment indicate partial technical impact with no evidence of active exploitation.
Path traversal vulnerability in Poetry's tar extraction function allows arbitrary file writes when processing untrusted source distributions on Python 3.10.0-3.10.12 and 3.11.0-3.11.4, where the tarfile.data_filter safety mechanism is absent or broken. The vulnerability is triggered during dependency resolution (poetry add --lock) or installation before the build backend executes, enabling attackers to write files outside the intended extraction directory via crafted tar member paths, symlinks, or hardlinks in malicious sdists.
Local file inclusion in Breaking News WP plugin for WordPress (versions up to 1.3) allows authenticated attackers with Subscriber-level access to read arbitrary files on the server. The vulnerability stems from insufficient path validation in the brnwp_show_breaking_news_wp() shortcode handler, which passes unsanitized user input directly to PHP's include() function after stripping only text field characters but not directory traversal sequences. Attackers can exploit the unprotected brnwp_ajax_form AJAX endpoint to overwrite the brnwp_theme option with paths like ../../../../etc/passwd, then trigger file inclusion when the shortcode renders.
Path traversal fix bypass in WWBN AVideo 29.0 and below allows authenticated uploaders to read arbitrary files from the server and exfiltrate them through a public GIF media URL. The partial fix in commit 2375eb5e0 validated only the URL path component via PHP's `parse_url()`, but the downstream `try_get_contents_from_local()` function in `objects/functionsFile.php` parses the full URL string - including query parameters - using `explode('/videos/', $url)`, enabling traversal payloads embedded in the query string to bypass the check entirely. A detailed proof-of-concept is publicly available in the GHSA-f4f9-627c-jh33 advisory; no CISA KEV listing exists, and EPSS at 0.20% reflects low automated exploitation probability consistent with the required authentication barrier.
Path traversal in nesquena hermes-webui allows any authenticated user to redirect a session workspace to an arbitrary existing directory on the host filesystem by supplying attacker-controlled paths to four POST endpoints. Once the workspace is redirected, the attacker leverages the application's own file read and write APIs to access or modify files well outside the intended workspace sandbox, bounded only by the OS-level permissions of the hermes-webui process. No public exploit is identified at time of analysis and this is not listed in CISA KEV; vendor-patched release v0.50.34 is available.
VolumeMount path restriction bypass in Tekton Pipelines prior to v1.11.1 permits authenticated users holding Task or TaskRun creation permissions to mount volumes over internal /tekton/ paths using dot-dot traversal sequences, violating Tekton's internal execution isolation boundary. The flaw exists in both the v1 and v1beta1 API validation layers (pkg/apis/pipeline/v1/container_validation.go and pkg/apis/pipeline/v1beta1/task_validation.go), where strings.HasPrefix is applied to the raw, un-normalized mount path instead of the filepath.Clean-resolved form. No public exploit code has been identified and SSVC assessment confirms no active exploitation; however, in shared or multi-tenant Kubernetes CI/CD environments the integrity risk is meaningful - an attacker can inject falsified task results trusted by downstream pipelines, alter step scripts before execution, or disrupt entrypoint coordination state.
Erlang OTP SSH daemon (ssh_sftpd) stores unresolved user-supplied paths in file handles, allowing authenticated SFTP users to modify file attributes (permissions, ownership, timestamps) outside the configured chroot directory via SSH_FXP_FSETSTAT requests. When the SSH daemon runs as root, this enables privilege escalation through setting setuid bits or changing ownership of system files. The vulnerability affects OTP versions 17.0 through 28.4.3 (and earlier point releases in 27.x and 26.x series); patched versions are available per vendor advisory.
Jupyter nbconvert 6.5 through 7.17.0 allows unauthenticated remote attackers to read arbitrary files from the conversion host when HTMLExporter.embed_images is enabled, by embedding malicious image references with path traversal sequences in a crafted notebook. A malicious actor can exfiltrate sensitive files as base64-encoded data URIs in the output HTML, achieving confidentiality breach with no integrity or availability impact. Vendor-released patch: version 7.17.1.
Arbitrary file write in Jupyter nbconvert 6.5 through 7.17.0 allows unauthenticated attackers to write files to arbitrary filesystem locations outside the intended output directory by crafting malicious cell attachment filenames in notebooks. The ExtractAttachmentsPreprocessor fails to sanitize attachment filenames, enabling path traversal that provides full control over destination paths and file extensions. Requires user interaction (opening a malicious notebook) and is patched in version 7.17.1.
Roxy-WI versions prior to 8.2.6.4 allow authenticated attackers to read arbitrary files via path traversal in the POST /config/<service>/show API endpoint. The configver parameter is directly concatenated into a file path without proper validation, permitting directory escape sequences (../) to bypass the existing path guard. An authenticated user can exploit this to access sensitive configuration files and other data readable by the web application process.
OpenMage LTS Dataflow module prior to version 20.17.0 allows authenticated administrators to read arbitrary files via a bypassable path traversal filter that uses simple string replacement (`str_replace('../', '', $input)`). Attackers can circumvent the blacklist by using nested patterns like `..././` or `....//` which resolve to valid `../` sequences after filtering. Remote administrative access is required, but the high confidentiality impact and confirmed patch availability make immediate patching necessary for affected deployments.
Path traversal in p2r3 convert's Bun.serve API endpoint allows authenticated remote attackers to access arbitrary files on the server by manipulating the pathname parameter in buildCache.js. The vulnerability affects all versions up to commit 6998584ace3e11db66dff0b423612a5cf91de75b, with publicly available exploit code and no vendor patch forthcoming due to non-response from the maintainer. CVSS score of 5.3 reflects limited scope (confidentiality only) but the public exploit and authenticated attack vector present moderate operational risk.
Remote authenticated path traversal in SonicCloudOrg sonic-server up to version 2.0.0 allows attackers with low-level privileges to manipulate the Type parameter in the File Upload Endpoint (FileTool.java) to traverse the filesystem and read or write arbitrary files. The vulnerability has publicly available exploit code and affects all versions up to 2.0.0; the vendor has not responded to early disclosure attempts, leaving no patch available.
Path traversal in TransformerOptimus SuperAGI versions up to 0.0.14 allows remote unauthenticated attackers to read, write, or delete arbitrary files via manipulated 'Name' parameter in multipart upload requests. Publicly available exploit code exists (GitHub Gist) demonstrating exploitation. EPSS data unavailable, not currently listed in CISA KEV. CVSS 7.3 reflects network-accessible attack with no authentication barrier, though impact is rated as 'Low' across confidentiality, integrity, and availability - likely indicating file system scope limitations rather than full system compromise.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files on the server by manipulating the Name argument in the LoadImage Node's folder_paths.get_annotated_filepath function. The vulnerability has publicly available exploit code and affects the image loading functionality, enabling attackers with valid credentials to access sensitive files outside intended directories.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files via manipulation of the get_model_preview function in the Model Preview Endpoint. An attacker with valid credentials can traverse the file system to access sensitive configuration files, model weights, or other data outside intended directories. Public exploit code is available, and the vendor has not provided a patched version despite early disclosure notification.
Path traversal in kodcloud KodExplorer 4.52 and earlier allows unauthenticated remote attackers to access unauthorized files via the public share handler's path parameter. The vulnerability has publicly available exploit code (EPSS data not provided, not listed in CISA KEV). The vendor did not respond to responsible disclosure, leaving all versions through 4.52 unpatched at time of analysis.
gdown prior to version 5.2.2 allows remote attackers to write arbitrary files outside the intended extraction directory via maliciously crafted ZIP or TAR archives due to insufficient path traversal validation in the extractall functionality. An attacker can craft a malicious archive with path traversal sequences (e.g., ../ entries) in filenames, which when extracted by a user, permits file overwrite and potential remote code execution. The vulnerability requires user interaction (UI:R) to trigger extraction but affects all unauthenticated remote users downloading via the gdown library.
Anviz CX7 Firmware allows authenticated administrators to upload malicious CSV files that exploit path traversal (CWE-23) to overwrite system files such as /etc/shadow, enabling unauthorized SSH access when combined with debug setting modifications. The vulnerability requires high-privilege authentication but poses significant risk in environments where administrative accounts are compromised or untrusted administrators have access.
Path traversal in prasathmani TinyFileManager up to version 2.6 allows authenticated remote attackers to manipulate the file[] POST parameter in /filemanager.php to read, modify, or delete arbitrary files on the server outside the intended directory scope. CVSS 5.4 reflects the authenticated requirement and lack of confidentiality impact, though integrity and availability are compromised. Public exploit code exists and the vendor has not responded to disclosure, leaving users dependent on manual patching or upgrading.
Path traversal in Qihui jtbc5 CMS 5.0.3.6 allows authenticated remote attackers to read arbitrary files via a manipulated path parameter in /dev/code/common/diplomat/manage.php. The vulnerability has a published exploit and affects the Code Endpoint component; the vendor has not responded to early disclosure. With CVSS 4.3 and EPSS probability marked as Proof-of-Concept, this represents a moderate confidentiality risk limited to authenticated users.
CubeCart administrative users can exploit a path traversal vulnerability prior to version 6.6.0 to read files from higher-level directories on the server, bypassing intended directory access restrictions. The vulnerability requires administrative privileges and affects CubeCart installations below 6.6.0. No active exploitation or public proof-of-concept has been identified; the low CVSS score (2.7) reflects the requirement for elevated privileges, making this a post-compromise lateral movement vector rather than an initial access risk.
JetBackup plugin for WordPress versions up to 3.1.19.8 allows authenticated administrators to delete arbitrary directories via path traversal in the file upload handler. The vulnerability stems from insufficient input validation on the fileName parameter, which is sanitized using sanitize_text_field() but still permits path traversal sequences like '../'. When combined with the recursive directory deletion logic in the cleanup routine, attackers can traverse outside the intended upload directory and delete critical WordPress directories such as wp-content/plugins, completely disabling all plugins and severely disrupting the WordPress installation.
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths accessible to the Node.js process when the directory listing feature is explicitly enabled. The flaw resides in dirList.path(), which uses Node.js path.join() without verifying the resolved path remains within the configured static root, making URL sequences like /public/../etc/ sufficient to escape the intended boundary. No active exploitation has been identified (SSVC Exploitation: none; EPSS: 0.02%), though the attack is automatable against susceptible configurations; disclosure is limited to directory and file names only - file contents are not readable via this path.
Cross-Site Request Forgery (CSRF) in Career Section WordPress plugin versions ≤1.6 enables unauthenticated attackers to delete arbitrary server files through social engineering. Attackers trick authenticated WordPress administrators into clicking malicious links that exploit missing nonce validation in the delete action handler, leading to path traversal and unrestricted file deletion. CVSS 8.8 (High) with network attack vector but requires user interaction (UI:R). EPSS and KEV data not provided; public exploit code status unknown. Wordfence advisory and upstream patch commit available.
Path traversal in Grafana Loki 2.3.0 through 3.5.8 allows unauthenticated remote attackers to read arbitrary files on the server via double encoding of the namespace parameter in the Ruler API endpoint /loki/api/v1/rules/{namespace}. This bypasses the fix for CVE-2021-36156, which sanitized the parameter only after a single URL decode. While the CVSS base score is 5.3 (Medium), EPSS exploitation probability is extremely low (0.01%), and no active exploitation or public exploit code is known.
Low-severity path traversal in Weblate prior to 5.17 allows authenticated users to bypass repository boundary checks by crafting symlinks with colliding path prefixes, potentially reading files outside the intended repository scope. No active exploitation or public exploit code is known, and the vulnerability has been patched in version 5.17.
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation memory API. Versions prior to 5.17 are affected; the fix in 5.17 adds filename validation to prevent directory traversal and restricts remote URLs to allowed domains. No active exploitation has been reported (CISA KEV not listed, SSVC exploitation status none), and EPSS risk is very low (0.04%).
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authenticated administrator to read arbitrary files on the underlying operating system via crafted HTTP requests. The vulnerability requires valid administrative credentials. No public exploit code or active exploitation has been reported.
Arbitrary directory deletion in Eleganzo theme for WordPress up to version 1.2 allows authenticated attackers with Subscriber-level access to delete any server directory, including the WordPress root directory, via a path traversal flaw in the akd_required_plugin_callback function. No active exploitation or public proof-of-concept is known, and EPSS probability is very low.
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated administrators with read-write permissions to write or delete arbitrary files via malicious CLI commands, potentially compromising system integrity and availability across multiple Fortinet product lines. The vulnerability affects FortiOS 6.4 through 7.6.4, FortiProxy 7.0 through 7.6.4, FortiPAM 1.0 through 1.7.0, and FortiSwitchManager 7.0 through 7.2.7. With a CVSS score of 6.0 a
Path traversal vulnerability in Fortinet FortiAnalyzer and FortiManager (versions 7.0 through 7.6.4, including Cloud variants) allows privileged local attackers to delete arbitrary files from the underlying filesystem via crafted CLI requests. The vulnerability affects both on-premises and cloud deployments across multiple major versions. CVSS 6.0 reflects moderate integrity and availability impact, constrained by requirement for high-privilege CLI access and local attack vector.
Path traversal in Fujian Apex LiveBOS through the /feed/UploadImage.do endpoint allows remote attackers to manipulate the filename parameter and write files to arbitrary locations on the server. Versions up to 2.0 are affected. Public exploit code is available. Upgrading to version 2.1 resolves the vulnerability.
Path traversal in IBM Langflow Desktop versions 1.8.4 and earlier allows authenticated remote attackers to read arbitrary files on the system by crafting URLs containing directory traversal sequences (/../). The vulnerability affects the file handling mechanism and could expose sensitive configuration, source code, or other confidential files accessible to the Langflow process. A vendor-released patch is available.
Authenticated attackers can exploit a path traversal vulnerability in IBM Langflow Desktop 1.2.0 through 1.8.4 to write arbitrary files to the system by crafting URLs containing directory traversal sequences (/../). The vulnerability requires prior authentication but allows complete bypass of file system restrictions, enabling file overwrite or creation outside intended directories with no integrity protections.
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Path traversal in ZMCPTools up to version 0.2.2 allows authenticated remote attackers to read or manipulate files outside intended directories via the dirname argument in the MCP Log Resource Handler component. The vulnerability is exploitable over the network by authenticated users with low privileges, has publicly available exploit code, and carries a CVSS score of 2.1 reflecting low confidentiality and integrity impact with no scope expansion.
Path traversal in Admidio's document add mode allows authenticated attackers to register arbitrary server files into document folders via unvalidated `name` parameter, enabling arbitrary file read when combined with CSRF. A low-privileged user can trick a documents administrator into clicking a malicious link to register sensitive files like `install/config.php` (containing database credentials) into a publicly accessible documents folder, then download those files using the attacker's own session. The vulnerability chains insufficient input validation (accepts `../` sequences), missing CSRF protection on the `add` action, and `SameSite=Lax` cookies that permit cross-site GET requests from administrators.
Path traversal in Admidio ecard_preview.php allows authenticated users to read arbitrary server files including database credentials by bypassing filename validation on the ecard_template POST parameter. An authenticated attacker can supply path traversal payloads such as ../config.php to read adm_my_files/config.php containing unencrypted database host, username, and password, or traverse further to access system files. Exploitation requires only a regular member account with no special privileges, making this a high-impact vulnerability accessible to any registered user.
Path traversal in mcpo-simple-server 0.2.0 and earlier enables unauthenticated remote attackers to delete arbitrary files via the delete_shared_prompt function. The vulnerability affects the prompt_manager module's base_manager.py file, where improper validation of the 'detail' parameter allows directory traversal sequences. A public proof-of-concept exploit exists (GitHub issue #4), making this an immediate threat to internet-exposed instances. EPSS data not available, but the combination of network exploitability (AV:N), no authentication required (PR:N), and public POC significantly elevates real-world risk despite moderate CVSS 7.3 score. Vendor has not responded to early disclosure.
Path traversal in geldata gel-mcp 0.1.0 allows remote unauthenticated attackers to read arbitrary files via manipulation of the rule_name argument in the list_rules and fetch_rule functions. The vulnerability has a CVSS score of 5.3 (Low confidentiality impact) with network accessibility and no authentication requirements. Public exploit code exists and the vendor has not responded to early disclosure.
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows authenticated attackers to disclose arbitrary files by injecting path traversal. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LifeSize ClearSea 3.1.4 contains directory traversal vulnerabilities that allow authenticated attackers to download and upload arbitrary files by manipulating path parameters in the smartgui. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in geekgod382 filesystem-mcp-server 1.0.0 allows unauthenticated remote attackers to read or write files outside the server's intended allowed directories by supplying path sequences that bypass the flawed `is_path_allowed()` check in `server.py`. Both `read_file_tool` and `write_file_tool` are affected, enabling arbitrary file exfiltration or overwrite on the host. A public exploit POC exists on GitHub; SSVC rates this as automatable with partial technical impact, though EPSS at 0.05% (16th percentile) reflects the product's niche deployment footprint rather than low exploitability. No CISA KEV listing. Vendor-released patch v1.1.0 is available.
Path traversal in BioinfoMCP's Upload Endpoint allows remote unauthenticated attackers to read or write files outside the intended directory by manipulating the Name argument in the Upload function (bioinfo_mcp_platform/app.py). The affected product is florensiawidjaja's BioinfoMCP at or before commit 7ada7918b9e515604d3c0ae264d3a9af10bf6e54, a bioinformatics platform using continuous rolling releases. A public exploit exists via GitHub issue report, and SSVC classifies the attack as automatable with partial technical impact; however, EPSS remains very low at 0.05% (14th percentile), consistent with an obscure research tool rather than widespread enterprise software. No vendor patch or response has been issued as of the time of this analysis.
Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attackers through the WeChat Work (WeCom) platform adapter component. The vulnerability resides in gateway/platforms/wecom.py and is limited to confidentiality impact (VC:L), with no integrity or availability consequence. A public proof-of-concept exists per GitHub issue reference, though EPSS of 0.05% (15th percentile) and SSVC's 'Automatable: no' designation indicate constrained real-world exploitation risk; no CISA KEV listing has been confirmed.
Path traversal in SonicWall SonicOS enables authenticated attackers on adjacent networks to access services that are normally restricted to privileged system internals. Affecting multiple SonicOS branches (6.x, 7.0.x, 7.3.x, 8.x), successful exploitation can result in high availability impact alongside limited confidentiality and integrity gains, per the CVSS impact metrics. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, with EPSS at 0.01% (2nd percentile), indicating negligible in-the-wild exploitation pressure at time of analysis.
Path traversal in fatbobman mail-mcp-bridge versions 1.3.0 through 1.3.3 exposes arbitrary filesystem paths to remote unauthenticated attackers via unsanitized `message_ids` arguments in the MCP server's attachment management functions. The vulnerable code in `cleanup_attachments.py` and `extract_attachments.py` directly concatenated email Message-ID values onto a base filesystem path without validation, allowing sequences such as `../../etc` to escape the intended attachment directory. A public exploit exists (GitHub issue #2), SSVC rates the attack as automatable, and vendor-released fix version 1.3.4 is available.
Path traversal in ezequiroga/mcp-bases `search_papers` function allows unauthenticated remote attackers to read and potentially write files outside the intended directory by supplying crafted `../` sequences in the `topic` argument to research_server.py. Two specific commits (357ca19 and c630b8a) are confirmed affected; the project's rolling release model means no versioned fix exists and the maintainer had not responded to disclosure at time of reporting. A public proof-of-concept exploit is available via GitHub, and SSVC rates exploitation as automatable with partial technical impact - a notable combination despite the low EPSS of 0.05%.
Cockpit CMS versions 2.13.5 and earlier allow authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets via directory traversal in the Buckets component. The vulnerability requires valid user authentication and does not impact confidentiality, but enables integrity compromise through malicious file placement or asset replacement. A proof-of-concept exists, though the SSVC framework rates automatable exploitation as unlikely, suggesting manual attack steps are required.
Path traversal in elinsky's execution-system-mcp 0.1.0 allows remote unauthenticated attackers to escape the intended directory boundary by manipulating the `context` argument passed to the `_get_context_file_path` function via the `add_action` tool, enabling read and potential write access to arbitrary files on the host filesystem. A public proof-of-concept exploit is confirmed (GitHub issue #1, VulDB 359972), and SSVC classifies the attack as automatable with partial technical impact. Despite EPSS at 0.08% reflecting the product's obscurity, the no-auth network-exploitable attack surface means any exposed instance faces meaningful risk.
Path traversal in elie's mcp-project 0.1.0 exposes local filesystem paths through the `search_papers` function in `research_server.py`, where the unsanitized `topic` argument can be manipulated to traverse directory boundaries. The vulnerability produces partial confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L) and is confined to local attack scenarios. A public proof-of-concept exists per SSVC and VulDB reporting, though EPSS places exploitation probability at 0.02% (4th percentile) and SSVC confirms the attack is not automatable - indicating low real-world threat despite POC availability.
Path traversal in eiceblue spire-pdf-mcp-server 0.1.1 allows unauthenticated remote attackers to escape the intended PDF directory by supplying crafted traversal sequences in the filepath argument to the get_pdf_path function, enabling unauthorized read and write access to arbitrary files on the host. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions, and a published exploit is confirmed (E:P). No vendor patch is available; the project maintainer has not responded to the responsible disclosure filed in GitHub issue #1.
Path traversal in eiceblue spire-doc-mcp-server 1.0.0 allows remote unauthenticated attackers to escape the intended document directory by supplying crafted sequences in the `document_name` argument to the `get_doc_path` function in `src/spire_doc_mcp/api/base.py`. A public exploit exists and SSVC confirms the attack is automatable with partial technical impact across confidentiality, integrity, and availability. No vendor patch is available - the project has not responded to the coordinated disclosure filed via GitHub issue.
Filesystem policy bypass in OpenClaw's Feishu docx upload pipeline (upload_file and upload_image endpoints) enables authenticated users to read local files outside the intended workspace-only boundary via path traversal. All npm versions of openclaw prior to 2026.4.8 are affected; this is explicitly an incomplete fix of a prior advisory (GHSA-qf48-qfv4-jjm9), indicating the original control was partially circumvented. No active exploitation has been identified - SSVC rates exploitation as none, EPSS sits at 0.04% (12th percentile), and the vulnerability is absent from CISA KEV - with a vendor-confirmed patch available at version 2026.4.8.
OpenClaw before version 2026.4.2 allows authenticated attackers to delete arbitrary remote directories during mirror mode synchronization operations by manipulating remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. An attacker with login credentials can craft malicious OpenShell config paths that cause the mirror sync function to delete unintended remote directory contents before replacing them with uploaded workspace data, resulting in data loss and potential service disruption.
Path traversal in DV0x creative-ad-agent server component (up to commit 751b9e5146604dc65049bd0f62dcbdad6212f8a3) allows remote unauthenticated attackers to read arbitrary files via manipulation of req.params arguments in server/sdk-server.ts. Public exploit code is available. CVSS 5.5 reflects low confidentiality impact with network-accessible attack vector and no authentication requirement.
Path traversal in WilliamCloudQi matlab-mcp-server allows remote unauthenticated attackers to manipulate the scriptPath argument in the generate_matlab_code and execute_matlab_code functions, enabling unauthorized file system access with confidentiality and integrity impact. The vulnerability affects versions up to commit ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca, has publicly available exploit code, and the vendor has not yet responded to early disclosure notification.
Path traversal in AgiFlow scaffold-mcp's write-to-file tool allows remote unauthenticated attackers to read, write, or delete arbitrary files on the server by manipulating the file_path parameter. Versions up to 1.0.27 are affected. Public exploit code exists (GitHub issue #88), enabling attackers to bypass directory restrictions and access sensitive files or overwrite critical system files. CVSS 7.3 (High) with network attack vector and no authentication required. Vendor-released patch available in version 1.1.0 (commit c4d23592).
Path traversal vulnerability in ErlichLiu claude-agent-sdk-master allows remote unauthenticated attackers to read arbitrary files by manipulating the outputFile parameter in app/api/agent-output/route.ts. The vulnerability has a CVSS score of 5.3 (low integrity impact) and publicly available exploit code exists, though the project uses rolling releases and the maintainer has not yet responded to disclosure.
Path traversal in browser-operator-core versions up to 0.6.0 allows remote unauthenticated attackers to read, write, and potentially delete arbitrary files on the server by manipulating the request.url parameter in the startsWith function of server.js. Publicly available exploit code exists (GitHub issue #96), enabling trivial exploitation with no user interaction. CVSS 7.3 reflects network-exploitable attack with low impact across confidentiality, integrity, and availability. No vendor response or patch released despite early responsible disclosure via issue report. This is a critical supply chain risk for any systems running the affected BrowserOperator component server.
Absolute path traversal in Deepractice PromptX up to version 2.4.0 allows remote unauthenticated attackers to read arbitrary files from the server by manipulating the path argument in document file handling functions (read_docx, read_xlsx, read_pptx, list_xlsx_sheets, read_pdf). Publicly available exploit code exists and the vendor has not responded to early disclosure, though CVSS 5.3 (AV:N/AC:L/PR:N/UI:N) indicates moderate information disclosure risk with no integrity or availability impact.
Path traversal in processing-claude-mcp-bridge's create_sketch tool allows remote unauthenticated attackers to read, write, or delete arbitrary files on the server by manipulating the sketch_name parameter in processing_server.py. Public exploit code exists via GitHub issue #1, enabling straightforward attacks against exposed instances. EPSS data not available, but CVSS 7.3 (High) with network vector and no authentication requirements indicates significant risk for internet-facing deployments. Project maintainer has not responded to vulnerability disclosure, leaving no vendor-confirmed patch timeline.
Path traversal in eghuzefa engineer-your-data up to version 0.1.3 allows remote attackers to read, write, list, and obtain information about arbitrary files via manipulation of the WORKSPACE_PATH argument in the read_file, write_file, list_files, and file_inf functions within src/server.py. Publicly available exploit code exists, and the vendor has been notified but has not yet responded with a fix.
Path traversal in ef10007 MLOps_MCP 1.0.0 allows remote unauthenticated attackers to write files to arbitrary filesystem locations via manipulation of the filename/destination argument in the save_file tool of fastmcp_server.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification, leaving affected deployments without an official patch.
Path traversal in duartium papers-mcp-server allows remote unauthenticated attackers to access arbitrary files on the server by manipulating the topic argument in the search_papers function. The vulnerability affects commit 9ceb3812a6458ba7922ca24a7406f8807bc55598 and is publicly exploitable with proof-of-concept code available; the vendor has been notified via issue report but has not yet responded.
Path traversal in edvardlindelof notes-mcp up to version 0.1.4 allows remote unauthenticated attackers to read or manipulate files outside the intended directory by manipulating the root_dir or path arguments in notes_mcp.py. The vulnerability has a publicly available exploit and a CVSS score of 6.9, but the vendor has not responded to the early disclosure through issue tracking.
OpenClaw versions 2026.2.6 through 2026.3.24 allow authenticated remote attackers to read arbitrary files outside configured sandbox boundaries via path traversal in the Feishu extension's resolveUploadInput function during upload_image operations. The vulnerability bypasses file-system sandbox restrictions through improper path resolution, enabling confidentiality compromise of sensitive data accessible to the application process.
Path traversal in OSPG binwalk 2.4.3 and earlier allows local low-privileged attackers to read or write files outside the intended extraction directory by supplying a crafted WinCE firmware image that manipulates the `self.file_name` argument in the `read_null_terminated_string` function of the WinCE Extraction Plugin. A public proof-of-concept exploit exists, though EPSS sits at 0.01% (2nd percentile) and CISA KEV lists no confirmed active exploitation, indicating negligible real-world uptake. The project maintainer has acknowledged the flaw but confirmed no patch will be released, as binwalk 2.x is end-of-life; migration to binwalk v3 is the only vendor-endorsed resolution.
Path traversal in CPython's `shutil.unpack_archive()` on Windows allows arbitrary file writes outside the intended extraction directory when processing ZIP archives containing Windows drive-letter absolute paths (e.g., `C:\...`, `D:\...`). The existing sanitization in `_unpack_zipfile()` rejected only Unix-style absolute paths (`/`) and directory traversal sequences (`..`), leaving Windows drive specifiers completely unchecked. No public exploit has been identified at time of analysis; EPSS of 0.05% (14th percentile) and SSVC exploitation status of 'none' indicate no observed exploitation, though the high integrity impact warrants patching in environments that process untrusted ZIP archives on Windows.
Path traversal in douinc mkdocs-mcp-plugin 0.4.0 and 0.4.1 exposes arbitrary server filesystem files to remote unauthenticated attackers via unsanitized docs_dir and file_path arguments in the read_document and list_documents functions of server.py. A public proof-of-concept is available on GitHub (issue #6), and SSVC classifies the attack as automatable, lowering the bar for mass exploitation. No patched version has been released at time of analysis; the vendor has acknowledged the issue and committed to publishing a fix within days.
Path traversal in kaggle-mcp's `prepare_kaggle_dataset` function exposes the host filesystem to remote unauthenticated attackers via unsanitized `competition_id` input. Any deployment of this Model Context Protocol server at commit 406127ff or earlier is affected across all platforms. A publicly disclosed exploit exists and SSVC confirms the attack is automatable, meaning attackers can read, write, or partially disrupt arbitrary server files without credentials or user interaction; the maintainer has not responded to the coordinated disclosure issue filed on GitHub.
Unauthenticated directory traversal in Pro-Bit versions before 1.77.4 exposes sensitive directories and subdirectories to remote attackers without authentication. The vulnerability allows direct access to protected file system locations via network requests, enabling unauthorized information disclosure. EPSS score of 0.02% (6th percentile) indicates low observed exploitation probability in the wild, and no CISA KEV listing exists at time of analysis, suggesting limited active exploitation despite the CVSS 7.5 severity rating.
Path traversal in the Blocks module of Daylight Studio FuelCMS v1.5.2 enables authenticated low-privileged users to read arbitrary server-side files outside the web root by injecting directory traversal sequences into the module's path parameter. A public proof-of-concept is confirmed via SSVC exploitation status and the pentest-tools advisory (PTT-2025-031), though no active exploitation appears in CISA KEV. With an EPSS of 0.06% (19th percentile) and a read-only, non-automatable attack profile, this represents a real but low-urgency confidentiality risk - file disclosure rather than code execution.
Path traversal in code-projects Online Lot Reservation System 1.0 allows unauthenticated remote attackers to read arbitrary files from the server by supplying directory traversal sequences in the unsanitized `File` parameter of `/download.php`. A public proof-of-concept exploit is available on GitHub, and SSVC classifies the attack as automatable with partial technical impact, though EPSS at 0.04% (13th percentile) indicates negligible observed exploitation activity to date. No CISA KEV listing exists, suggesting exploitation remains opportunistic rather than widespread.
Path traversal in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to access files outside intended directories via the url parameter in the downloadApp endpoint (src/routes/setting/about/downloadApp.ts). The vulnerability requires high attack complexity and authenticated access; vendor mitigation notes that the update URL is statically compiled in official code and exploitation would require users to modify source code. Publicly disclosed exploit code exists, but real-world exploitability is disputed by the vendor and remains uncertain.
Path traversal in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to read arbitrary files via manipulation of the url argument in the updateStoryboardUrl function of the Storyboard Export component. The vulnerability has a publicly available exploit, though the vendor disputes its practical exploitability, arguing the affected interface is designed to accept only local or trusted Docker-configured addresses. CVSS 4.3 reflects low confidence (RC:C) and unconfirmed exploitation probability (E:P).
Path traversal in MiroFish up to version 0.1.2 allows remote unauthenticated attackers to read arbitrary files via manipulation of the Platform query parameter in the get_simulation_posts function. The vulnerability affects the backend simulation API endpoint and has publicly available exploit code, though exploitation is limited to information disclosure rather than modification or availability impact.
Path traversal in Tenda i9 router firmware version 1.0.0.5(2204) allows remote unauthenticated attackers to access arbitrary files, modify system configurations, and potentially disrupt device operation via the R7WebsSecurityHandlerfunction in the HTTP Handler component. Publicly available exploit code exists on GitHub (Litengzheng/vuldb_new), enabling straightforward exploitation with EPSS-assessed risk. The vulnerability permits confidentiality, integrity, and availability impacts with low attack complexity and no required user interaction, making it a realistic target for automated scanning and exploitation.
Path traversal in rawchen sims DeleteFileServlet endpoint allows authenticated remote attackers to manipulate the filename parameter and access arbitrary files on the system, potentially leading to information disclosure or file modification. The vulnerability affects all versions up to commit 004f783b1db5ecdfad81c8fdc3b34171211112de, with publicly available exploit code and no vendor response to early disclosure notification.
Path traversal vulnerability in Ollama up to version 0.20.2 affects the digestToPath function in the Tensor Model Transfer Handler, allowing remote attackers with high complexity to manipulate digest arguments and traverse the filesystem. Public exploit code exists, though the vendor has not acknowledged disclosure attempts. CVSS 6.3 reflects low confidentiality, integrity, and availability impact limited by high attack complexity and no scope change.
FreeRDP versions prior to 3.25.0 allow path traversal attacks through an off-by-one error in the drive redirection filter, enabling rogue RDP servers to read, list, or write files one directory above the client's shared folder via RDPDR requests. Exploitation requires the victim to connect with drive redirection enabled and interact with a malicious RDP server, making this a user-interaction-dependent remote attack with moderate CVSS score (4.2) but real-world impact limited by connection and configuration requirements.
Path traversal in Chainguard melange's `--persist-lint-results` feature allows an attacker who controls the contents of a processed APK to write attacker-influenced JSON files to arbitrary filesystem locations reachable by the melange process. Affected versions span v0.32.0 through v0.43.3; the root cause is that `arch` and `pkgname` values from the APK's `.PKGINFO` control file were used unsanitized in output path construction. No direct code execution is possible, but the write primitive can clobber other JSON artifacts on the build host. No public exploit code exists and CISA KEV does not list this vulnerability.
Path traversal in Chainguard's melange build tool (versions >= 0.32.0, < 0.43.4) allows an attacker who can influence a melange configuration file to escape the designated pipeline directory via `../` sequences or absolute paths in `pipeline[].uses`, enabling both arbitrary file reads and shell command execution within the build sandbox. This is acutely dangerous in pull-request-driven CI or build-as-a-service scenarios where untrusted contributors can submit melange configs that are automatically built without review. No public exploit has been identified at time of analysis; EPSS of 0.01% and SSVC exploitation status 'none' confirm no observed active exploitation, but the impact of arbitrary shell execution during a trusted build pipeline makes this high-priority for affected CI deployments.
Path traversal in radare2's project notes handling exposes arbitrary filesystem files to read and overwrite when a user imports a crafted .zrp archive. All radare2 releases prior to 6.1.4 are vulnerable via the `r_core_project_notes_file()` function in `libr/core/project.c`, which failed to detect symlinks within imported project archives before performing note operations. An attacker who can deliver and persuade a victim to import a malicious .zrp file can escape the configured `dir.projects` directory entirely, gaining low confidentiality and high integrity impact on the host filesystem. No active exploitation is confirmed in CISA KEV, but a working proof-of-concept is publicly available in the referenced GitHub PR test suite.
Path traversal in radare2's project deletion function (r_core_project_delete in libr/core/project.c) allows a local attacker to cause recursive deletion of arbitrary directories by supplying crafted absolute project paths that escape the configured dir.projects root. All versions prior to 6.1.4 are affected. An attacker who controls a project file path can cause radare2 - running with the victim's permissions - to wipe arbitrary directories, resulting in significant integrity and availability impact. No public exploit identified at time of analysis for weaponized in-the-wild use; however, a publicly available exploit (POC) exists via the upstream GitHub PR, and SSVC rates technical impact as total despite non-automatable exploitation.
Arbitrary file write vulnerability in IBM Guardium Data Protection 12.1 allows authenticated administrative users to traverse directories and write files to arbitrary locations via specially crafted URLs containing path traversal sequences (/../). The vulnerability requires high-privilege admin credentials and network access but results in integrity compromise without requiring user interaction, making it a post-authentication privilege abuse risk for organizations running this data protection platform.
Path traversal in DDEV versions prior to 1.25.2 allows remote attackers to write files outside intended extraction directories when downloading and extracting archives from remote sources. The vulnerability affects the Untar() and Unzip() functions in pkg/archive/archive.go, which lack path validation during extraction. Exploitation requires user interaction (UI:R) to trigger archive extraction but can achieve high integrity impact through arbitrary file write. A proof-of-concept exists, and CISA SSVC framework rates this as exploitable with partial technical impact.
The rm utility in uutils coreutils fails to properly validate current directory paths with trailing slashes (./ or .///), allowing local users with write access to silently delete all contents of the current directory via rm -rf ./ while the utility reports a misleading 'Invalid input' error. CVSS score 5.6 reflects local attack vector and required user interaction, though the impact is severe data loss with potential recovery complications.
Time-of-Check to Time-of-Use (TOCTOU) symlink race condition vulnerability in uutils coreutils affects directory traversal operations on macOS and FreeBSD because the safe_traversal module's file-descriptor-relative syscall protections are incorrectly limited to Linux targets only. Local authenticated attackers with limited privileges can exploit this race condition to read or modify files via symlink manipulation, though exploitation requires specific timing conditions and is not automatable. EPSS and CISA SSVC assessment indicate partial technical impact with no evidence of active exploitation.
Path traversal vulnerability in Poetry's tar extraction function allows arbitrary file writes when processing untrusted source distributions on Python 3.10.0-3.10.12 and 3.11.0-3.11.4, where the tarfile.data_filter safety mechanism is absent or broken. The vulnerability is triggered during dependency resolution (poetry add --lock) or installation before the build backend executes, enabling attackers to write files outside the intended extraction directory via crafted tar member paths, symlinks, or hardlinks in malicious sdists.
Local file inclusion in Breaking News WP plugin for WordPress (versions up to 1.3) allows authenticated attackers with Subscriber-level access to read arbitrary files on the server. The vulnerability stems from insufficient path validation in the brnwp_show_breaking_news_wp() shortcode handler, which passes unsanitized user input directly to PHP's include() function after stripping only text field characters but not directory traversal sequences. Attackers can exploit the unprotected brnwp_ajax_form AJAX endpoint to overwrite the brnwp_theme option with paths like ../../../../etc/passwd, then trigger file inclusion when the shortcode renders.
Path traversal fix bypass in WWBN AVideo 29.0 and below allows authenticated uploaders to read arbitrary files from the server and exfiltrate them through a public GIF media URL. The partial fix in commit 2375eb5e0 validated only the URL path component via PHP's `parse_url()`, but the downstream `try_get_contents_from_local()` function in `objects/functionsFile.php` parses the full URL string - including query parameters - using `explode('/videos/', $url)`, enabling traversal payloads embedded in the query string to bypass the check entirely. A detailed proof-of-concept is publicly available in the GHSA-f4f9-627c-jh33 advisory; no CISA KEV listing exists, and EPSS at 0.20% reflects low automated exploitation probability consistent with the required authentication barrier.
Path traversal in nesquena hermes-webui allows any authenticated user to redirect a session workspace to an arbitrary existing directory on the host filesystem by supplying attacker-controlled paths to four POST endpoints. Once the workspace is redirected, the attacker leverages the application's own file read and write APIs to access or modify files well outside the intended workspace sandbox, bounded only by the OS-level permissions of the hermes-webui process. No public exploit is identified at time of analysis and this is not listed in CISA KEV; vendor-patched release v0.50.34 is available.
VolumeMount path restriction bypass in Tekton Pipelines prior to v1.11.1 permits authenticated users holding Task or TaskRun creation permissions to mount volumes over internal /tekton/ paths using dot-dot traversal sequences, violating Tekton's internal execution isolation boundary. The flaw exists in both the v1 and v1beta1 API validation layers (pkg/apis/pipeline/v1/container_validation.go and pkg/apis/pipeline/v1beta1/task_validation.go), where strings.HasPrefix is applied to the raw, un-normalized mount path instead of the filepath.Clean-resolved form. No public exploit code has been identified and SSVC assessment confirms no active exploitation; however, in shared or multi-tenant Kubernetes CI/CD environments the integrity risk is meaningful - an attacker can inject falsified task results trusted by downstream pipelines, alter step scripts before execution, or disrupt entrypoint coordination state.
Erlang OTP SSH daemon (ssh_sftpd) stores unresolved user-supplied paths in file handles, allowing authenticated SFTP users to modify file attributes (permissions, ownership, timestamps) outside the configured chroot directory via SSH_FXP_FSETSTAT requests. When the SSH daemon runs as root, this enables privilege escalation through setting setuid bits or changing ownership of system files. The vulnerability affects OTP versions 17.0 through 28.4.3 (and earlier point releases in 27.x and 26.x series); patched versions are available per vendor advisory.
Jupyter nbconvert 6.5 through 7.17.0 allows unauthenticated remote attackers to read arbitrary files from the conversion host when HTMLExporter.embed_images is enabled, by embedding malicious image references with path traversal sequences in a crafted notebook. A malicious actor can exfiltrate sensitive files as base64-encoded data URIs in the output HTML, achieving confidentiality breach with no integrity or availability impact. Vendor-released patch: version 7.17.1.
Arbitrary file write in Jupyter nbconvert 6.5 through 7.17.0 allows unauthenticated attackers to write files to arbitrary filesystem locations outside the intended output directory by crafting malicious cell attachment filenames in notebooks. The ExtractAttachmentsPreprocessor fails to sanitize attachment filenames, enabling path traversal that provides full control over destination paths and file extensions. Requires user interaction (opening a malicious notebook) and is patched in version 7.17.1.
Roxy-WI versions prior to 8.2.6.4 allow authenticated attackers to read arbitrary files via path traversal in the POST /config/<service>/show API endpoint. The configver parameter is directly concatenated into a file path without proper validation, permitting directory escape sequences (../) to bypass the existing path guard. An authenticated user can exploit this to access sensitive configuration files and other data readable by the web application process.
OpenMage LTS Dataflow module prior to version 20.17.0 allows authenticated administrators to read arbitrary files via a bypassable path traversal filter that uses simple string replacement (`str_replace('../', '', $input)`). Attackers can circumvent the blacklist by using nested patterns like `..././` or `....//` which resolve to valid `../` sequences after filtering. Remote administrative access is required, but the high confidentiality impact and confirmed patch availability make immediate patching necessary for affected deployments.
Path traversal in p2r3 convert's Bun.serve API endpoint allows authenticated remote attackers to access arbitrary files on the server by manipulating the pathname parameter in buildCache.js. The vulnerability affects all versions up to commit 6998584ace3e11db66dff0b423612a5cf91de75b, with publicly available exploit code and no vendor patch forthcoming due to non-response from the maintainer. CVSS score of 5.3 reflects limited scope (confidentiality only) but the public exploit and authenticated attack vector present moderate operational risk.
Remote authenticated path traversal in SonicCloudOrg sonic-server up to version 2.0.0 allows attackers with low-level privileges to manipulate the Type parameter in the File Upload Endpoint (FileTool.java) to traverse the filesystem and read or write arbitrary files. The vulnerability has publicly available exploit code and affects all versions up to 2.0.0; the vendor has not responded to early disclosure attempts, leaving no patch available.
Path traversal in TransformerOptimus SuperAGI versions up to 0.0.14 allows remote unauthenticated attackers to read, write, or delete arbitrary files via manipulated 'Name' parameter in multipart upload requests. Publicly available exploit code exists (GitHub Gist) demonstrating exploitation. EPSS data unavailable, not currently listed in CISA KEV. CVSS 7.3 reflects network-accessible attack with no authentication barrier, though impact is rated as 'Low' across confidentiality, integrity, and availability - likely indicating file system scope limitations rather than full system compromise.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files on the server by manipulating the Name argument in the LoadImage Node's folder_paths.get_annotated_filepath function. The vulnerability has publicly available exploit code and affects the image loading functionality, enabling attackers with valid credentials to access sensitive files outside intended directories.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files via manipulation of the get_model_preview function in the Model Preview Endpoint. An attacker with valid credentials can traverse the file system to access sensitive configuration files, model weights, or other data outside intended directories. Public exploit code is available, and the vendor has not provided a patched version despite early disclosure notification.
Path traversal in kodcloud KodExplorer 4.52 and earlier allows unauthenticated remote attackers to access unauthorized files via the public share handler's path parameter. The vulnerability has publicly available exploit code (EPSS data not provided, not listed in CISA KEV). The vendor did not respond to responsible disclosure, leaving all versions through 4.52 unpatched at time of analysis.
gdown prior to version 5.2.2 allows remote attackers to write arbitrary files outside the intended extraction directory via maliciously crafted ZIP or TAR archives due to insufficient path traversal validation in the extractall functionality. An attacker can craft a malicious archive with path traversal sequences (e.g., ../ entries) in filenames, which when extracted by a user, permits file overwrite and potential remote code execution. The vulnerability requires user interaction (UI:R) to trigger extraction but affects all unauthenticated remote users downloading via the gdown library.
Anviz CX7 Firmware allows authenticated administrators to upload malicious CSV files that exploit path traversal (CWE-23) to overwrite system files such as /etc/shadow, enabling unauthorized SSH access when combined with debug setting modifications. The vulnerability requires high-privilege authentication but poses significant risk in environments where administrative accounts are compromised or untrusted administrators have access.
Path traversal in prasathmani TinyFileManager up to version 2.6 allows authenticated remote attackers to manipulate the file[] POST parameter in /filemanager.php to read, modify, or delete arbitrary files on the server outside the intended directory scope. CVSS 5.4 reflects the authenticated requirement and lack of confidentiality impact, though integrity and availability are compromised. Public exploit code exists and the vendor has not responded to disclosure, leaving users dependent on manual patching or upgrading.
Path traversal in Qihui jtbc5 CMS 5.0.3.6 allows authenticated remote attackers to read arbitrary files via a manipulated path parameter in /dev/code/common/diplomat/manage.php. The vulnerability has a published exploit and affects the Code Endpoint component; the vendor has not responded to early disclosure. With CVSS 4.3 and EPSS probability marked as Proof-of-Concept, this represents a moderate confidentiality risk limited to authenticated users.
CubeCart administrative users can exploit a path traversal vulnerability prior to version 6.6.0 to read files from higher-level directories on the server, bypassing intended directory access restrictions. The vulnerability requires administrative privileges and affects CubeCart installations below 6.6.0. No active exploitation or public proof-of-concept has been identified; the low CVSS score (2.7) reflects the requirement for elevated privileges, making this a post-compromise lateral movement vector rather than an initial access risk.
JetBackup plugin for WordPress versions up to 3.1.19.8 allows authenticated administrators to delete arbitrary directories via path traversal in the file upload handler. The vulnerability stems from insufficient input validation on the fileName parameter, which is sanitized using sanitize_text_field() but still permits path traversal sequences like '../'. When combined with the recursive directory deletion logic in the cleanup routine, attackers can traverse outside the intended upload directory and delete critical WordPress directories such as wp-content/plugins, completely disabling all plugins and severely disrupting the WordPress installation.
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths accessible to the Node.js process when the directory listing feature is explicitly enabled. The flaw resides in dirList.path(), which uses Node.js path.join() without verifying the resolved path remains within the configured static root, making URL sequences like /public/../etc/ sufficient to escape the intended boundary. No active exploitation has been identified (SSVC Exploitation: none; EPSS: 0.02%), though the attack is automatable against susceptible configurations; disclosure is limited to directory and file names only - file contents are not readable via this path.
Cross-Site Request Forgery (CSRF) in Career Section WordPress plugin versions ≤1.6 enables unauthenticated attackers to delete arbitrary server files through social engineering. Attackers trick authenticated WordPress administrators into clicking malicious links that exploit missing nonce validation in the delete action handler, leading to path traversal and unrestricted file deletion. CVSS 8.8 (High) with network attack vector but requires user interaction (UI:R). EPSS and KEV data not provided; public exploit code status unknown. Wordfence advisory and upstream patch commit available.
Path traversal in Grafana Loki 2.3.0 through 3.5.8 allows unauthenticated remote attackers to read arbitrary files on the server via double encoding of the namespace parameter in the Ruler API endpoint /loki/api/v1/rules/{namespace}. This bypasses the fix for CVE-2021-36156, which sanitized the parameter only after a single URL decode. While the CVSS base score is 5.3 (Medium), EPSS exploitation probability is extremely low (0.01%), and no active exploitation or public exploit code is known.
Low-severity path traversal in Weblate prior to 5.17 allows authenticated users to bypass repository boundary checks by crafting symlinks with colliding path prefixes, potentially reading files outside the intended repository scope. No active exploitation or public exploit code is known, and the vulnerability has been patched in version 5.17.
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation memory API. Versions prior to 5.17 are affected; the fix in 5.17 adds filename validation to prevent directory traversal and restricts remote URLs to allowed domains. No active exploitation has been reported (CISA KEV not listed, SSVC exploitation status none), and EPSS risk is very low (0.04%).
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authenticated administrator to read arbitrary files on the underlying operating system via crafted HTTP requests. The vulnerability requires valid administrative credentials. No public exploit code or active exploitation has been reported.
Arbitrary directory deletion in Eleganzo theme for WordPress up to version 1.2 allows authenticated attackers with Subscriber-level access to delete any server directory, including the WordPress root directory, via a path traversal flaw in the akd_required_plugin_callback function. No active exploitation or public proof-of-concept is known, and EPSS probability is very low.
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated administrators with read-write permissions to write or delete arbitrary files via malicious CLI commands, potentially compromising system integrity and availability across multiple Fortinet product lines. The vulnerability affects FortiOS 6.4 through 7.6.4, FortiProxy 7.0 through 7.6.4, FortiPAM 1.0 through 1.7.0, and FortiSwitchManager 7.0 through 7.2.7. With a CVSS score of 6.0 a
Path traversal vulnerability in Fortinet FortiAnalyzer and FortiManager (versions 7.0 through 7.6.4, including Cloud variants) allows privileged local attackers to delete arbitrary files from the underlying filesystem via crafted CLI requests. The vulnerability affects both on-premises and cloud deployments across multiple major versions. CVSS 6.0 reflects moderate integrity and availability impact, constrained by requirement for high-privilege CLI access and local attack vector.