Path Traversal
Monthly
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4. [CVSS 8.1 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder allows Path Traversal.This issue affects BM Content Builder: from n/a before 3.16.3.3. [CVSS 6.5 MEDIUM]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through <= 1.6.1. [CVSS 8.6 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through <= 7.0. [CVSS 7.5 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0. [CVSS 7.3 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0. [CVSS 8.6 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through <= 1.1.5. [CVSS 8.6 HIGH]
Arbitrary file read in EduSoho versions prior to 22.4.7 lets a remote, unauthenticated attacker retrieve any file on the server through the classroom-course-statistics export feature. By injecting path-traversal sequences into the fileNames[] parameter, an attacker can pull sensitive files such as config/parameters.yml, exposing database credentials and application secrets. Publicly available exploit code exists, and the Shadowserver Foundation reported observing exploitation evidence on 2026-01-19, though the flaw is not listed as CISA KEV in the provided data; EPSS remains low at 0.13%.
Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function. [CVSS 6.0 MEDIUM]
A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software. [CVSS 6.5 MEDIUM]
Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. [CVSS 7.2 HIGH]
Malicious wheel files can modify file permissions on critical system files during extraction in Python wheel versions 0.40.0-0.46.1, enabling attackers to alter SSH keys, configuration files, or executable scripts. This path traversal and permission manipulation flaw affects systems unpacking untrusted wheels and can lead to privilege escalation or arbitrary code execution. Public exploit code exists for this vulnerability, though a patch is available in version 0.46.2.
The resolveSafeChildPath function in Backstage's backend-plugin-api prior to version 0.1.17 improperly validates symlink chains and dangling symlinks, allowing authenticated attackers to bypass path traversal protections used by Scaffolder actions and other backend components. An attacker with low privileges could exploit this to access files outside the intended directory boundaries by chaining intermediate symlinks or creating symlinks pointing to non-existent paths that are later materialized during file operations. This affects Backstage installations relying on the vulnerable path validation function for security isolation.
Mini Mouse 9.2.0 contains a path traversal vulnerability that allows remote attackers to access arbitrary system files and directories through crafted HTTP requests. [CVSS 7.5 HIGH]
Mini Mouse 9.3.0 contains a path traversal vulnerability that allows attackers to access sensitive system directories through the device information endpoint. Attackers can retrieve file lists from system directories like /usr, /etc, and /var by manipulating file path parameters in API requests. [CVSS 6.2 MEDIUM]
NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API. [CVSS 7.5 HIGH]
Swing Music is a self-hosted music player for local audio files. versions up to 2.1.4 contains a security vulnerability.
Path traversal in Sanluan PublicCMS up to version 5.202506.d allows remote attackers with high privileges to manipulate the path parameter in the Task Template Management handler, enabling unauthorized file access or manipulation. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.
SteelSeries Nahimic 3 1.10.7 allows Directory traversal. [CVSS 7.8 HIGH]
TOA Corporation TRIFORA 3 series network cameras contain a path traversal vulnerability that allows authenticated users with monitoring privileges or higher to read arbitrary files from the device. An attacker with valid credentials can exploit this flaw to access sensitive information stored on the affected cameras. No patch is currently available for this vulnerability.
Gotac's Police Statistics Database System contains a path traversal vulnerability that enables unauthenticated remote attackers to enumerate system directories and access sensitive files. The flaw affects industrial and law enforcement deployments with network accessibility, potentially exposing confidential database contents and system architecture details. No patch is currently available for this medium-severity vulnerability.
GeoVision GeoWebServer 5.3.3 contains multiple vulnerabilities including local file inclusion, cross-site scripting, and remote code execution through improper input sanitization. [CVSS 6.2 MEDIUM]
DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. [CVSS 8.1 HIGH]
Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the ExternalGetFile action. Only files with an extension can be read. [CVSS 7.5 HIGH]
Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. [CVSS 7.5 HIGH]
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration. [CVSS 5.3 MEDIUM]
An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges. [CVSS 5.5 MEDIUM]
The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. [CVSS 4.4 MEDIUM]
Gotham Block Extra Light (WordPress plugin) versions up to 1.5.0 is affected by path traversal (CVSS 6.5).
Integration Opvius AI for WooCommerce (through 1.3.0) has unauthenticated path traversal allowing arbitrary file download and deletion. No authentication, no nonce verification, no path validation.
e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. [CVSS 7.2 HIGH]
Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by manipulating file paths under the /js/ path. [CVSS 7.5 HIGH]
Owlfiles File Manager 12.0.1 contains a path traversal vulnerability in its built-in HTTP server that allows attackers to access system directories. [CVSS 7.5 HIGH]
CuteEditor for PHP (now referred to as Rich Text Editor) 6.6 contains a directory traversal vulnerability in the browse template feature that allows attackers to write files to arbitrary web root directories. [CVSS 7.5 HIGH]
YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests. [CVSS 5.5 MEDIUM]
An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 6.5 MEDIUM]
Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. [CVSS 8.2 HIGH]
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests. [CVSS 6.5 MEDIUM]
In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal. [CVSS 7.5 HIGH]
Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module [CVSS 5.5 MEDIUM]
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. [CVSS 8.1 HIGH]
A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. [CVSS 6.5 MEDIUM]
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Path Traversal.This issue affects DX NetOps Spectrum: 24.3.8 and earlier. [CVSS 6.5 MEDIUM]
React Router (@react-router/node 7.0.0-7.9.3) has a path traversal in file-based session storage when using unsigned cookies. Attackers can manipulate session file paths to read or write arbitrary files on the server.
In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized access to sensitive information within the system [CVSS 7.5 HIGH]
Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webroot directory using a direct HTTP request. [CVSS 6.5 MEDIUM]
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. [CVSS 8.8 HIGH]
Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through <= 2.3.8. [CVSS 7.5 HIGH]
The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site. [CVSS 6.5 MEDIUM]
FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unverified input parameters. [CVSS 6.2 MEDIUM]
Arbitrary file disclosure in REDAXO's Backup addon allows authenticated users with backup permissions to read any file within the webroot by bypassing directory validation in the file export function. An attacker can manipulate the EXPDIR parameter with path traversal sequences to include unauthorized files in exported archives. Public exploit code exists; a patch is available in version 5.20.2 and later.
MONAI versions up to 1.5.1 contain a path traversal vulnerability in the `_download_from_ngc_private()` function that fails to validate extracted archive contents, allowing attackers to write files outside the intended directory during package extraction. An attacker with user interaction can exploit this via a malicious ZIP file to overwrite arbitrary files on the system. Public exploit code exists for this vulnerability, and a patch is available in commit 4014c8475626f20f158921ae0cf98ed259ae4d59.
RustFS (alpha.13 to alpha.78) has a path traversal in /rustfs/rpc/read_file_stream that allows reading arbitrary files on the server. PoC available, fixed in alpha.79.
Filesystem-Mcp versions up to 0.5.8 contains a vulnerability that allows attackers to bypass directory restrictions by leveraging symlinks within the allowed director (CVSS 7.5).
fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper path validation that fails to resolve symbolic links to their actual physical paths. [CVSS 7.5 HIGH]
Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO: from n/a through 3.2.10. [CVSS 6.4 MEDIUM]
The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode. [CVSS 6.5 MEDIUM]
The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. [CVSS 6.5 MEDIUM]
The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.8.8 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. [CVSS 7.5 HIGH]
SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGI script. [CVSS 6.5 MEDIUM]
undocumented proxy API is affected by inclusion of functionality from untrusted control sphere (CVSS 7.5).
The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. [CVSS 7.2 HIGH]
Path traversal in the FastDup WordPress plugin through version 2.7 allows authenticated contributors and above to enumerate and read arbitrary directories on affected servers via a malicious 'dir_path' parameter in the REST API. This vulnerability enables attackers with low-level WordPress access to access sensitive files and configuration data without requiring elevated privileges or user interaction.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. [CVSS 5.3 MEDIUM]
Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. [CVSS 7.5 HIGH]
Local file inclusion and path traversal in the Node.js builds of jsPDF (dist/jspdf.node.js and dist/jspdf.node.min.js) prior to version 4.0.0 lets an attacker who controls the path argument passed to loadFile, addImage, html, or addFont read arbitrary files from the host filesystem, with the file contents embedded verbatim into the generated PDF. Applications that forward unsanitized user input into these methods leak secrets such as /etc/passwd, configuration files, or private keys to anyone who can request a PDF. No public exploit identified at time of analysis; EPSS risk is very low (0.02%, 6th percentile) and the issue is not in CISA KEV.
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability. [CVSS 4.3 MEDIUM]
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability. [CVSS 4.3 MEDIUM]
A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. [CVSS 5.4 MEDIUM]
Path traversal in the yeqifu Warehouse application's file handling function allows authenticated attackers to read arbitrary files on the system through manipulated path parameters. Public exploit code exists for this vulnerability, increasing the risk of exploitation. The rolling-release nature of the product means affected users lack clear version guidance and no official patch is currently available.
AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem.
An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. [CVSS 7.5 HIGH]
A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 7.5 HIGH]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of the file /file/downloadShowFile.action of the component com.yeqifu.sys.controller.FileController. [CVSS 5.3 MEDIUM]
Path traversal in Pro Bulk Watermark Plugin for WordPress (versions through 2.0) exposes arbitrary server files to authenticated attackers via the '.../...//' obfuscation technique, which bypasses naive path sanitization. The CVSS vector (PR:L) confirms that a low-privileged authenticated user - such as a subscriber or contributor - can exploit this to read sensitive files. No public exploit code or active exploitation has been identified at time of analysis, and EPSS sits at a very low 0.06%.
Cross-Site Request Forgery (CSRF) in Everest Backup WordPress plugin versions ≤2.3.11 enables unauthenticated attackers to manipulate backup file paths via path traversal, potentially exposing sensitive files or altering backup integrity. The vulnerability requires user interaction (CVSS UI:R) and carries no authentication requirement (PR:N), allowing remote exploitation through social engineering. EPSS probability of 0.01% (1st percentile) indicates minimal observed exploitation activity in the wild, and no public exploit identified at time of analysis. Despite CVSS 8.1 severity reflecting high confidentiality and integrity impact, real-world risk remains moderate given the user-interaction dependency and absence of active exploitation indicators.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-15245. We must output JSON with specific fields. First, gather data: - CVE ID: CVE-2025-15245 - Description: D-Link DCS-850L firmware 1.02.09, uploadfirmware function in Firmware Update Service, path traversal via DownloadFile argument. Attack from local network. Exploit public. Product unsupported. - CVSS: provided as 4.0 vector: AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. So base score 2.0 (low) with public exploit. - EPSS: 0.09% (25th percentile), low - KEV: Not mentioned, so not in CISA KEV. So exploitation status: no public exploit identified? But POC/Exploit says "Publicly available". The description says "The exploit has been made public and could be used." So POC exists. No KEV. So exploitation status: "publicly available exploit code exists". No evidence of active exploitation. - CWE-22: Path traversal. - Tags: D-Link, Path Traversal, Dcs 850L Firmware - References: nvd links include exploit writeup, vuldb, dlink homepage. - CPE: cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09:*:*:*:*:*:*:* (firmware only). Product: D-Link DCS-850L (IP camera). Firmware version 1.02.09. - CVSS vector analysis: Attack vector Adjacent (AV:A), so local network required. Attack Complexity Low (AC:L), Attack Requirements None (AT:N). Privileges Required Low (PR:L) – so some authentication. User Interaction None (UI:N). Vulnerable System Confidentiality Impact Low (VC:L), Integrity None, Availability None. No scope change. So impact limited confidentiality loss (path traversal could allow reading files). Exploit maturity: P (Proof-of-Concept). So overall score is low due to low impact and adjacent network requirement. - The product is no longer supported, so no official patch. That means remediation should suggest specific compensating controls. Now, we need to write each field as a plain text string, a coherent paragraph. product_name: just the product. "D-Link DCS-850L" is good. summary: 2-3 sentences. Must not start with "A vulnerability". Start with impactful verb: "Path traversal in firmware update service of D-Link DCS-850L allows..." Mention affected version, unauthenticated? CVSS says PR:L so requires low privileges. Attack from local network. Public exploit exists. Not actively exploited, EPSS low. Since unsupported, no patch. Use the phrases: "publicly available exploit code exists". It's a low-risk vulnerability overall. So summary: "Path traversal in the Firmware Update Service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." technical_context: Need to explain underlying tech: Firmware update service likely uses a download mechanism that doesn't sanitize user-supplied path, leading to CWE-22 path traversal. Mention the CPE for exact product. So: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." risk_assessment: Assess using all signals. CVSS: AV:A, AC:L, PR:L, UI:N, scope unchanged, VC:L, VI:N, VA:N. Exploit maturity P. So attack must be from local network, requires low privileges (like authenticated user or someone on the LAN with credentials?), impact is only low confidentiality (file read). EPSS 0.09% indicates low exploitation likelihood. No KEV, so not actively exploited. POC exists but low real-world risk due to adjacent vector and low impact. Product unsupported, so risk is for legacy devices still in use. Mention contrast: "While a public exploit exists, the CVSS score is low (2.0) due to the adjacent network requirement, required low privileges, and limited confidentiality impact (no integrity or availability loss). EPSS score of 0.09% further suggests low exploitation probability. Not listed in CISA KEV, so no active exploitation. The risk is largely limited to environments where unsupported DCS-850L cameras are still deployed and exposed to untrusted local networks." affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." remediation: No patch available, so suggest compensating controls. Start with "The D-Link DCS-850L is no longer supported, and no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with other known vulnerabilities, so replacement is strongly recommended." Mention advisory URLs: vuldb references. exploit_scenario: "An attacker who has gained access to the local network (e.g., via compromised Wi-Fi credentials) can send a crafted request to the camera's firmware update endpoint with a path traversal payload in the DownloadFile parameter, allowing them to read arbitrary files from the device's filesystem, such as configuration files containing sensitive information. A public proof-of-concept is available." exploitation_conditions: Need specific prerequisites. From description: "The attack must originate from the local network." So adjacent network access. CVSS PR:L means low privileges, implying that the attacker needs some level of authentication (like a valid user account on the camera, or maybe the service is only accessible after login). So conditions: "Exploitation requires an attacker to have network adjacency to the target device, such as being on the same local network segment, and to possess low-privileged credentials to authenticate to the firmware update service. The vulnerability is not exploitable remotely over the internet without SSDP/UPnP misconfigurations. The product is end-of-life and no longer supported, so no patch is forthcoming." No specific configuration required beyond default. attack_chain: "Obtain local network access (e.g., via Wi-Fi) → Authenticate to camera web interface with low-privilege credentials → Craft HTTP request to firmware update service with path traversal in DownloadFile parameter → Camera parses malicious path, traverses directory → Read sensitive file contents, exfiltrate data." That's a chain. confidence_notes: "All data from VulDB via CNA@vuldb.com. EPSS score and CPE from NVD are as provided. No vendor advisory from D-Link confirms unsupported status. POC is publicly available at the referenced Notion page; no independent verification of exploit success. CVSS vector suggests low privileges and adjacent network, but the actual authentication requirement (e.g., whether default credentials may be sufficient) is not fully detailed. Impact appears limited to reading files only, no integrity or availability compromise." prevalence: The product is a D-Link IP camera model DCS-850L. It's an older model, unsupported. Likely low deployment footprint. So "low". prevalence_basis: "unsupported legacy IP camera, low remaining enterprise footprint" assessed_cvss_vector: We need to independently assess. The CVSS 4.0 vector from VulDB is given, but we can assess a 3.1 vector. The vector characteristics: Attack Vector is Adjacent (AV:A) because local network. Attack Complexity Low (AC:L). Privileges Required Low (PR:L). User Interaction None (UI:N). Scope Unchanged (S:U). Confidentiality Low (C:L), Integrity None (I:N), Availability None (A:N). So 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. That matches the given 4.0 vector's mapping. So we'll output that. assessed_cvss_rationale: "Adjacent network access and low privileges are required, leading to AV:A and PR:L; only file read impact, so C:L/I:N/A:N." assessed_cvss40_vector: We can output the given CVSS 4.0 vector or a consistent one: the provided one is already there, but we need to produce our own. Given the same assessment, the 4.0 vector would be: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. No exploit maturity or environmental modifiers, just base. So output that. Now compile all into JSON. Ensure no arrays, only strings. Check each field: - product_name: "D-Link DCS-850L" - summary: A single paragraph. Must not start with "A vulnerability". So: "Path traversal in the firmware update service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." That's three sentences. Good. - technical_context: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." - risk_assessment: "While a public exploit exists, the CVSS score is low (2.0/4.0 or calculated 3.1 base score 3.5?) Actually recalc: AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N gives score 3.5/6.9? Wait, base score: AV:A, AC:L, PR:L, UI:N, S:U, C:L, I:N, A:N. Score: 3.5 (Medium). But the provided CVSS 4.0 score is 2.0, maybe they used different impact. We'll stick with the provided one. But our risk assessment should note the low severity. "The vulnerability presents low confidentiality impact only, and exploitation requires local network access and low privileges. EPSS score of 0.09% suggests limited real-world exploitation activity, and it is not listed in CISA KEV. The combined signals indicate this is a low-priority issue, primarily a concern only if unsupported legacy cameras remain in use on flat, untrusted networks." That's good. - affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." - remediation: "The D-Link DCS-850L is no longer supported, so no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with
Remote path traversal in GreenCMS up to version 2.3 allows authenticated high-privilege attackers to manipulate the sqlFiles/zipFiles parameters in the File Handler component, leading to unauthorized file access or modification. The vulnerability is exploitable over the network but requires administrative access; public exploit code exists, yet no active exploitation is confirmed. GreenCMS is end-of-life and no longer supported.
Path traversal in Tiny File Manager up to 2.6 allows authenticated attackers with high privileges to manipulate the fullpath parameter in tinyfilemanager.php, potentially reading, writing, or deleting files outside the web root. Public exploit code is available, but no active exploitation (CISA KEV) has been confirmed.
Directory traversal in Yealink SIP-T21P(E2) IP phone firmware 52.84.0.15 exposes arbitrary files to low-privileged remote attackers via a crafted request to the diagnostic component's result read function. The flaw is confined to confidentiality impact - attackers can exfiltrate sensitive files (credentials, configuration, logs) stored on the device but cannot modify or crash it. A publicly available proof-of-concept exists, though EPSS at 0.62% indicates limited observed exploitation activity and the device is not listed in the CISA KEV catalog.
Unauthenticated path traversal in Tenda CH22 router firmware 1.0.0.1 permits remote attackers to manipulate file paths via the /public/ endpoint. Exploitation can result in limited file disclosure, modification, or deletion. Public exploit code is available, but no active exploitation has been confirmed and EPSS indicates low probability of widespread attacks.
Path traversal in the FTP daemon service of Edimax BR-6208AC firmware version 1.02 allows authenticated remote attackers to access files outside the intended FTP directory via crafted FTP commands to the handle_retr function. The device is discontinued and unsupported; exploit code is publicly available. While CVSS score is low (2.1) and EPSS indicates minimal exploitation likelihood (0.12%), the vulnerability is real for the small population still using this legacy hardware.
Arbitrary file write in Streama (open-source self-hosted media server) versions 1.10.0 through 1.10.5 lets an authenticated user chain a path traversal flaw with a server-side request forgery in the subtitle download feature to plant files anywhere the application process can write, potentially escalating to remote code execution. The subtitle endpoint trusts both the remote fetch URL and the destination filename, so a crafted download link plus a '../' filename escapes the intended staging directory. There is no CISA KEV listing and no packaged exploit is flagged in the source data, though a detailed VulnCheck advisory and a public technical write-up (chocapikk.com) describe the mechanics.
Arbitrary file download in WordPress Tuturn plugin before version 3.6 allows authenticated users to read sensitive server files. No active exploitation or public exploit code has been reported; EPSS exploitation probability is low (0.07%).
Path traversal in Nozomi Networks CMC and Guardian allows authenticated users with limited privileges to write arbitrary files to any system location by uploading a malicious Arc data archive. This enables device configuration tampering and denial-of-service attacks. Attack requires low-privilege authentication but has high integrity and availability impact (CVSS 7.2). No public exploit identified at time of analysis, though the attack vector is straightforward for authenticated insiders or compromised accounts.
Remote unauthenticated arbitrary file upload with path traversal in WP Webhooks plugin up to version 3.3.8 allows full site compromise. Attackers can upload malicious files to arbitrary directories, leading to code execution and data theft. No user interaction required, but exploitation is of high complexity.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4. [CVSS 8.1 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder allows Path Traversal.This issue affects BM Content Builder: from n/a before 3.16.3.3. [CVSS 6.5 MEDIUM]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through <= 1.6.1. [CVSS 8.6 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through <= 7.0. [CVSS 7.5 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0. [CVSS 7.3 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0. [CVSS 8.6 HIGH]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through <= 1.1.5. [CVSS 8.6 HIGH]
Arbitrary file read in EduSoho versions prior to 22.4.7 lets a remote, unauthenticated attacker retrieve any file on the server through the classroom-course-statistics export feature. By injecting path-traversal sequences into the fileNames[] parameter, an attacker can pull sensitive files such as config/parameters.yml, exposing database credentials and application secrets. Publicly available exploit code exists, and the Shadowserver Foundation reported observing exploitation evidence on 2026-01-19, though the flaw is not listed as CISA KEV in the provided data; EPSS remains low at 0.13%.
Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function. [CVSS 6.0 MEDIUM]
A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software. [CVSS 6.5 MEDIUM]
Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. [CVSS 7.2 HIGH]
Malicious wheel files can modify file permissions on critical system files during extraction in Python wheel versions 0.40.0-0.46.1, enabling attackers to alter SSH keys, configuration files, or executable scripts. This path traversal and permission manipulation flaw affects systems unpacking untrusted wheels and can lead to privilege escalation or arbitrary code execution. Public exploit code exists for this vulnerability, though a patch is available in version 0.46.2.
The resolveSafeChildPath function in Backstage's backend-plugin-api prior to version 0.1.17 improperly validates symlink chains and dangling symlinks, allowing authenticated attackers to bypass path traversal protections used by Scaffolder actions and other backend components. An attacker with low privileges could exploit this to access files outside the intended directory boundaries by chaining intermediate symlinks or creating symlinks pointing to non-existent paths that are later materialized during file operations. This affects Backstage installations relying on the vulnerable path validation function for security isolation.
Mini Mouse 9.2.0 contains a path traversal vulnerability that allows remote attackers to access arbitrary system files and directories through crafted HTTP requests. [CVSS 7.5 HIGH]
Mini Mouse 9.3.0 contains a path traversal vulnerability that allows attackers to access sensitive system directories through the device information endpoint. Attackers can retrieve file lists from system directories like /usr, /etc, and /var by manipulating file path parameters in API requests. [CVSS 6.2 MEDIUM]
NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API. [CVSS 7.5 HIGH]
Swing Music is a self-hosted music player for local audio files. versions up to 2.1.4 contains a security vulnerability.
Path traversal in Sanluan PublicCMS up to version 5.202506.d allows remote attackers with high privileges to manipulate the path parameter in the Task Template Management handler, enabling unauthorized file access or manipulation. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.
SteelSeries Nahimic 3 1.10.7 allows Directory traversal. [CVSS 7.8 HIGH]
TOA Corporation TRIFORA 3 series network cameras contain a path traversal vulnerability that allows authenticated users with monitoring privileges or higher to read arbitrary files from the device. An attacker with valid credentials can exploit this flaw to access sensitive information stored on the affected cameras. No patch is currently available for this vulnerability.
Gotac's Police Statistics Database System contains a path traversal vulnerability that enables unauthenticated remote attackers to enumerate system directories and access sensitive files. The flaw affects industrial and law enforcement deployments with network accessibility, potentially exposing confidential database contents and system architecture details. No patch is currently available for this medium-severity vulnerability.
GeoVision GeoWebServer 5.3.3 contains multiple vulnerabilities including local file inclusion, cross-site scripting, and remote code execution through improper input sanitization. [CVSS 6.2 MEDIUM]
DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. [CVSS 8.1 HIGH]
Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the ExternalGetFile action. Only files with an extension can be read. [CVSS 7.5 HIGH]
Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. [CVSS 7.5 HIGH]
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration. [CVSS 5.3 MEDIUM]
An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges. [CVSS 5.5 MEDIUM]
The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. [CVSS 4.4 MEDIUM]
Gotham Block Extra Light (WordPress plugin) versions up to 1.5.0 is affected by path traversal (CVSS 6.5).
Integration Opvius AI for WooCommerce (through 1.3.0) has unauthenticated path traversal allowing arbitrary file download and deletion. No authentication, no nonce verification, no path validation.
e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. [CVSS 7.2 HIGH]
Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by manipulating file paths under the /js/ path. [CVSS 7.5 HIGH]
Owlfiles File Manager 12.0.1 contains a path traversal vulnerability in its built-in HTTP server that allows attackers to access system directories. [CVSS 7.5 HIGH]
CuteEditor for PHP (now referred to as Rich Text Editor) 6.6 contains a directory traversal vulnerability in the browse template feature that allows attackers to write files to arbitrary web root directories. [CVSS 7.5 HIGH]
YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests. [CVSS 5.5 MEDIUM]
An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 6.5 MEDIUM]
Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. [CVSS 8.2 HIGH]
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests. [CVSS 6.5 MEDIUM]
In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal. [CVSS 7.5 HIGH]
Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module [CVSS 5.5 MEDIUM]
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. [CVSS 8.1 HIGH]
A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. [CVSS 6.5 MEDIUM]
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Path Traversal.This issue affects DX NetOps Spectrum: 24.3.8 and earlier. [CVSS 6.5 MEDIUM]
React Router (@react-router/node 7.0.0-7.9.3) has a path traversal in file-based session storage when using unsigned cookies. Attackers can manipulate session file paths to read or write arbitrary files on the server.
In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized access to sensitive information within the system [CVSS 7.5 HIGH]
Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webroot directory using a direct HTTP request. [CVSS 6.5 MEDIUM]
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. [CVSS 8.8 HIGH]
Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through <= 2.3.8. [CVSS 7.5 HIGH]
The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site. [CVSS 6.5 MEDIUM]
FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unverified input parameters. [CVSS 6.2 MEDIUM]
Arbitrary file disclosure in REDAXO's Backup addon allows authenticated users with backup permissions to read any file within the webroot by bypassing directory validation in the file export function. An attacker can manipulate the EXPDIR parameter with path traversal sequences to include unauthorized files in exported archives. Public exploit code exists; a patch is available in version 5.20.2 and later.
MONAI versions up to 1.5.1 contain a path traversal vulnerability in the `_download_from_ngc_private()` function that fails to validate extracted archive contents, allowing attackers to write files outside the intended directory during package extraction. An attacker with user interaction can exploit this via a malicious ZIP file to overwrite arbitrary files on the system. Public exploit code exists for this vulnerability, and a patch is available in commit 4014c8475626f20f158921ae0cf98ed259ae4d59.
RustFS (alpha.13 to alpha.78) has a path traversal in /rustfs/rpc/read_file_stream that allows reading arbitrary files on the server. PoC available, fixed in alpha.79.
Filesystem-Mcp versions up to 0.5.8 contains a vulnerability that allows attackers to bypass directory restrictions by leveraging symlinks within the allowed director (CVSS 7.5).
fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper path validation that fails to resolve symbolic links to their actual physical paths. [CVSS 7.5 HIGH]
Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO: from n/a through 3.2.10. [CVSS 6.4 MEDIUM]
The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode. [CVSS 6.5 MEDIUM]
The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. [CVSS 6.5 MEDIUM]
The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.8.8 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. [CVSS 7.5 HIGH]
SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGI script. [CVSS 6.5 MEDIUM]
undocumented proxy API is affected by inclusion of functionality from untrusted control sphere (CVSS 7.5).
The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. [CVSS 7.2 HIGH]
Path traversal in the FastDup WordPress plugin through version 2.7 allows authenticated contributors and above to enumerate and read arbitrary directories on affected servers via a malicious 'dir_path' parameter in the REST API. This vulnerability enables attackers with low-level WordPress access to access sensitive files and configuration data without requiring elevated privileges or user interaction.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. [CVSS 5.3 MEDIUM]
Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. [CVSS 7.5 HIGH]
Local file inclusion and path traversal in the Node.js builds of jsPDF (dist/jspdf.node.js and dist/jspdf.node.min.js) prior to version 4.0.0 lets an attacker who controls the path argument passed to loadFile, addImage, html, or addFont read arbitrary files from the host filesystem, with the file contents embedded verbatim into the generated PDF. Applications that forward unsanitized user input into these methods leak secrets such as /etc/passwd, configuration files, or private keys to anyone who can request a PDF. No public exploit identified at time of analysis; EPSS risk is very low (0.02%, 6th percentile) and the issue is not in CISA KEV.
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability. [CVSS 4.3 MEDIUM]
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability. [CVSS 4.3 MEDIUM]
A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. [CVSS 5.4 MEDIUM]
Path traversal in the yeqifu Warehouse application's file handling function allows authenticated attackers to read arbitrary files on the system through manipulated path parameters. Public exploit code exists for this vulnerability, increasing the risk of exploitation. The rolling-release nature of the product means affected users lack clear version guidance and no official patch is currently available.
AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem.
An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. [CVSS 7.5 HIGH]
A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 7.5 HIGH]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of the file /file/downloadShowFile.action of the component com.yeqifu.sys.controller.FileController. [CVSS 5.3 MEDIUM]
Path traversal in Pro Bulk Watermark Plugin for WordPress (versions through 2.0) exposes arbitrary server files to authenticated attackers via the '.../...//' obfuscation technique, which bypasses naive path sanitization. The CVSS vector (PR:L) confirms that a low-privileged authenticated user - such as a subscriber or contributor - can exploit this to read sensitive files. No public exploit code or active exploitation has been identified at time of analysis, and EPSS sits at a very low 0.06%.
Cross-Site Request Forgery (CSRF) in Everest Backup WordPress plugin versions ≤2.3.11 enables unauthenticated attackers to manipulate backup file paths via path traversal, potentially exposing sensitive files or altering backup integrity. The vulnerability requires user interaction (CVSS UI:R) and carries no authentication requirement (PR:N), allowing remote exploitation through social engineering. EPSS probability of 0.01% (1st percentile) indicates minimal observed exploitation activity in the wild, and no public exploit identified at time of analysis. Despite CVSS 8.1 severity reflecting high confidentiality and integrity impact, real-world risk remains moderate given the user-interaction dependency and absence of active exploitation indicators.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-15245. We must output JSON with specific fields. First, gather data: - CVE ID: CVE-2025-15245 - Description: D-Link DCS-850L firmware 1.02.09, uploadfirmware function in Firmware Update Service, path traversal via DownloadFile argument. Attack from local network. Exploit public. Product unsupported. - CVSS: provided as 4.0 vector: AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. So base score 2.0 (low) with public exploit. - EPSS: 0.09% (25th percentile), low - KEV: Not mentioned, so not in CISA KEV. So exploitation status: no public exploit identified? But POC/Exploit says "Publicly available". The description says "The exploit has been made public and could be used." So POC exists. No KEV. So exploitation status: "publicly available exploit code exists". No evidence of active exploitation. - CWE-22: Path traversal. - Tags: D-Link, Path Traversal, Dcs 850L Firmware - References: nvd links include exploit writeup, vuldb, dlink homepage. - CPE: cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09:*:*:*:*:*:*:* (firmware only). Product: D-Link DCS-850L (IP camera). Firmware version 1.02.09. - CVSS vector analysis: Attack vector Adjacent (AV:A), so local network required. Attack Complexity Low (AC:L), Attack Requirements None (AT:N). Privileges Required Low (PR:L) – so some authentication. User Interaction None (UI:N). Vulnerable System Confidentiality Impact Low (VC:L), Integrity None, Availability None. No scope change. So impact limited confidentiality loss (path traversal could allow reading files). Exploit maturity: P (Proof-of-Concept). So overall score is low due to low impact and adjacent network requirement. - The product is no longer supported, so no official patch. That means remediation should suggest specific compensating controls. Now, we need to write each field as a plain text string, a coherent paragraph. product_name: just the product. "D-Link DCS-850L" is good. summary: 2-3 sentences. Must not start with "A vulnerability". Start with impactful verb: "Path traversal in firmware update service of D-Link DCS-850L allows..." Mention affected version, unauthenticated? CVSS says PR:L so requires low privileges. Attack from local network. Public exploit exists. Not actively exploited, EPSS low. Since unsupported, no patch. Use the phrases: "publicly available exploit code exists". It's a low-risk vulnerability overall. So summary: "Path traversal in the Firmware Update Service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." technical_context: Need to explain underlying tech: Firmware update service likely uses a download mechanism that doesn't sanitize user-supplied path, leading to CWE-22 path traversal. Mention the CPE for exact product. So: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." risk_assessment: Assess using all signals. CVSS: AV:A, AC:L, PR:L, UI:N, scope unchanged, VC:L, VI:N, VA:N. Exploit maturity P. So attack must be from local network, requires low privileges (like authenticated user or someone on the LAN with credentials?), impact is only low confidentiality (file read). EPSS 0.09% indicates low exploitation likelihood. No KEV, so not actively exploited. POC exists but low real-world risk due to adjacent vector and low impact. Product unsupported, so risk is for legacy devices still in use. Mention contrast: "While a public exploit exists, the CVSS score is low (2.0) due to the adjacent network requirement, required low privileges, and limited confidentiality impact (no integrity or availability loss). EPSS score of 0.09% further suggests low exploitation probability. Not listed in CISA KEV, so no active exploitation. The risk is largely limited to environments where unsupported DCS-850L cameras are still deployed and exposed to untrusted local networks." affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." remediation: No patch available, so suggest compensating controls. Start with "The D-Link DCS-850L is no longer supported, and no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with other known vulnerabilities, so replacement is strongly recommended." Mention advisory URLs: vuldb references. exploit_scenario: "An attacker who has gained access to the local network (e.g., via compromised Wi-Fi credentials) can send a crafted request to the camera's firmware update endpoint with a path traversal payload in the DownloadFile parameter, allowing them to read arbitrary files from the device's filesystem, such as configuration files containing sensitive information. A public proof-of-concept is available." exploitation_conditions: Need specific prerequisites. From description: "The attack must originate from the local network." So adjacent network access. CVSS PR:L means low privileges, implying that the attacker needs some level of authentication (like a valid user account on the camera, or maybe the service is only accessible after login). So conditions: "Exploitation requires an attacker to have network adjacency to the target device, such as being on the same local network segment, and to possess low-privileged credentials to authenticate to the firmware update service. The vulnerability is not exploitable remotely over the internet without SSDP/UPnP misconfigurations. The product is end-of-life and no longer supported, so no patch is forthcoming." No specific configuration required beyond default. attack_chain: "Obtain local network access (e.g., via Wi-Fi) → Authenticate to camera web interface with low-privilege credentials → Craft HTTP request to firmware update service with path traversal in DownloadFile parameter → Camera parses malicious path, traverses directory → Read sensitive file contents, exfiltrate data." That's a chain. confidence_notes: "All data from VulDB via CNA@vuldb.com. EPSS score and CPE from NVD are as provided. No vendor advisory from D-Link confirms unsupported status. POC is publicly available at the referenced Notion page; no independent verification of exploit success. CVSS vector suggests low privileges and adjacent network, but the actual authentication requirement (e.g., whether default credentials may be sufficient) is not fully detailed. Impact appears limited to reading files only, no integrity or availability compromise." prevalence: The product is a D-Link IP camera model DCS-850L. It's an older model, unsupported. Likely low deployment footprint. So "low". prevalence_basis: "unsupported legacy IP camera, low remaining enterprise footprint" assessed_cvss_vector: We need to independently assess. The CVSS 4.0 vector from VulDB is given, but we can assess a 3.1 vector. The vector characteristics: Attack Vector is Adjacent (AV:A) because local network. Attack Complexity Low (AC:L). Privileges Required Low (PR:L). User Interaction None (UI:N). Scope Unchanged (S:U). Confidentiality Low (C:L), Integrity None (I:N), Availability None (A:N). So 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. That matches the given 4.0 vector's mapping. So we'll output that. assessed_cvss_rationale: "Adjacent network access and low privileges are required, leading to AV:A and PR:L; only file read impact, so C:L/I:N/A:N." assessed_cvss40_vector: We can output the given CVSS 4.0 vector or a consistent one: the provided one is already there, but we need to produce our own. Given the same assessment, the 4.0 vector would be: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. No exploit maturity or environmental modifiers, just base. So output that. Now compile all into JSON. Ensure no arrays, only strings. Check each field: - product_name: "D-Link DCS-850L" - summary: A single paragraph. Must not start with "A vulnerability". So: "Path traversal in the firmware update service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." That's three sentences. Good. - technical_context: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." - risk_assessment: "While a public exploit exists, the CVSS score is low (2.0/4.0 or calculated 3.1 base score 3.5?) Actually recalc: AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N gives score 3.5/6.9? Wait, base score: AV:A, AC:L, PR:L, UI:N, S:U, C:L, I:N, A:N. Score: 3.5 (Medium). But the provided CVSS 4.0 score is 2.0, maybe they used different impact. We'll stick with the provided one. But our risk assessment should note the low severity. "The vulnerability presents low confidentiality impact only, and exploitation requires local network access and low privileges. EPSS score of 0.09% suggests limited real-world exploitation activity, and it is not listed in CISA KEV. The combined signals indicate this is a low-priority issue, primarily a concern only if unsupported legacy cameras remain in use on flat, untrusted networks." That's good. - affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." - remediation: "The D-Link DCS-850L is no longer supported, so no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with
Remote path traversal in GreenCMS up to version 2.3 allows authenticated high-privilege attackers to manipulate the sqlFiles/zipFiles parameters in the File Handler component, leading to unauthorized file access or modification. The vulnerability is exploitable over the network but requires administrative access; public exploit code exists, yet no active exploitation is confirmed. GreenCMS is end-of-life and no longer supported.
Path traversal in Tiny File Manager up to 2.6 allows authenticated attackers with high privileges to manipulate the fullpath parameter in tinyfilemanager.php, potentially reading, writing, or deleting files outside the web root. Public exploit code is available, but no active exploitation (CISA KEV) has been confirmed.
Directory traversal in Yealink SIP-T21P(E2) IP phone firmware 52.84.0.15 exposes arbitrary files to low-privileged remote attackers via a crafted request to the diagnostic component's result read function. The flaw is confined to confidentiality impact - attackers can exfiltrate sensitive files (credentials, configuration, logs) stored on the device but cannot modify or crash it. A publicly available proof-of-concept exists, though EPSS at 0.62% indicates limited observed exploitation activity and the device is not listed in the CISA KEV catalog.
Unauthenticated path traversal in Tenda CH22 router firmware 1.0.0.1 permits remote attackers to manipulate file paths via the /public/ endpoint. Exploitation can result in limited file disclosure, modification, or deletion. Public exploit code is available, but no active exploitation has been confirmed and EPSS indicates low probability of widespread attacks.
Path traversal in the FTP daemon service of Edimax BR-6208AC firmware version 1.02 allows authenticated remote attackers to access files outside the intended FTP directory via crafted FTP commands to the handle_retr function. The device is discontinued and unsupported; exploit code is publicly available. While CVSS score is low (2.1) and EPSS indicates minimal exploitation likelihood (0.12%), the vulnerability is real for the small population still using this legacy hardware.
Arbitrary file write in Streama (open-source self-hosted media server) versions 1.10.0 through 1.10.5 lets an authenticated user chain a path traversal flaw with a server-side request forgery in the subtitle download feature to plant files anywhere the application process can write, potentially escalating to remote code execution. The subtitle endpoint trusts both the remote fetch URL and the destination filename, so a crafted download link plus a '../' filename escapes the intended staging directory. There is no CISA KEV listing and no packaged exploit is flagged in the source data, though a detailed VulnCheck advisory and a public technical write-up (chocapikk.com) describe the mechanics.
Arbitrary file download in WordPress Tuturn plugin before version 3.6 allows authenticated users to read sensitive server files. No active exploitation or public exploit code has been reported; EPSS exploitation probability is low (0.07%).
Path traversal in Nozomi Networks CMC and Guardian allows authenticated users with limited privileges to write arbitrary files to any system location by uploading a malicious Arc data archive. This enables device configuration tampering and denial-of-service attacks. Attack requires low-privilege authentication but has high integrity and availability impact (CVSS 7.2). No public exploit identified at time of analysis, though the attack vector is straightforward for authenticated insiders or compromised accounts.
Remote unauthenticated arbitrary file upload with path traversal in WP Webhooks plugin up to version 3.3.8 allows full site compromise. Attackers can upload malicious files to arbitrary directories, leading to code execution and data theft. No user interaction required, but exploitation is of high complexity.