Path Traversal

Relative path traversal in Apache Tika's ISA-Tab parser (ISArchiveParser) enables arbitrary local file read against the Tika process. Specifically, the 'Study Assay File Name' field within an ISA-Tab investigation file is processed without adequate path sanitization, allowing traversal outside the intended dataset directory and causing the contents of any file readable by the Tika process to be emitted in the extracted text output. Affected deployments span Apache Tika 1.8 through 3.3.1 and the 4.0.0-alpha-1 preview release, all of which include the vulnerable tika-parser-scientific-module. No public exploit or CISA KEV listing was identified at time of analysis, but the vulnerability was independently reported by two researchers with proposed patches, indicating the issue is reproducible and well-understood.

Path traversal in Apache Zeppelin's FileSystemNotebookRepo backend (versions 0.9.0 through 0.12.0) allows authenticated users with note-rename or folder-operation permissions to escape the configured notebook root directory on the server's filesystem or HDFS. By injecting directory traversal sequences into note or folder path values, an attacker can cause Zeppelin to move, write, or delete files anywhere the server process identity has access - potentially overwriting arbitrary files outside the notebook root. No public exploit has been identified and exploitation requires specific authenticated access plus a non-default storage backend configuration.

Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Path traversal in the Wallpaper component of ASUSTOR Data Master (ADM) exposes arbitrary files to authenticated high-privileged attackers across two separate version branches. Affected NAS appliances running ADM 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81 allow an attacker who controls an admin-level account to submit crafted wallpaper path inputs containing traversal sequences, escaping the intended directory and reading files restricted only by the underlying OS user permissions. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the realistic attacker population.

Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authenticated remote user. The flaw, discovered by ZDI (ZDI-CAN-28713) and disclosed as ZDI-26-288, exists because the web service on TCP port 4568 accepts user-supplied path strings and passes them directly to file operations without sanitization, allowing directory traversal sequences to escape the intended working directory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor security bulletin has been published.

Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read arbitrary files in the context of the service account, bypassing all authentication controls. The root cause is unsanitized user-supplied path input passed directly into file operations (CWE-22), making exploitation mechanically trivial for any attacker with network reach to the affected port. No public exploit code or active exploitation has been identified at time of analysis; the ZDI-CAN-28719 disclosure was handled through the Zero Day Initiative responsible disclosure program.

Arbitrary file overwrite in Develar app-builder (all versions ≤ 4.2.0 on macOS) allows an unauthenticated remote attacker to escape the ZIP extraction directory by exploiting APFS Unicode case-folding combined with symlink following in the `zipx.Unzip` routine. A crafted archive containing a symlink entry `ss` pointing to an external victim file and a subsequent regular-file entry `ß` causes the builder to follow the symlink - because APFS folds `ß` to `ss` - overwriting the target with attacker-controlled content. SSVC rates the attack automatable with no confirmed exploitation; no public exploit code has been identified at time of analysis, though CERT/CC advisory VU#293714 and ENISA EUVD-2026-50423 confirm coordinated disclosure.

Unsafe tar extraction in Penelope Shell Handler (pip package penelope-shell-handler, versions prior to 0.19.3) enables a malicious or compromised remote session to write arbitrary files on the penetration tester's (operator's) machine by returning a crafted tar archive containing path-traversal entries such as `../`. The vulnerability is exclusively triggered by the Unix `download` command path and can be chained to operator-side code execution by overwriting `~/.penelope/peneloperc`, which Penelope `exec()`s on startup and on `reload`. A fully working proof-of-concept is included in the GitHub Security Advisory, demonstrating the complete file-write-to-RCE chain. No public record of active exploitation (CISA KEV) has been identified at time of analysis.

Path traversal in open-iscsi allows remote MITM attackers to create root-owned files at arbitrary filesystem locations and inject lines into records by embedding RFC 3722-prohibited characters in IQN target names returned during iSNS or firmware discovery. All open-iscsi versions through commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e are affected across the iSNS discovery, firmware discovery, and command-line target-name paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 score of 6.9 with network vector and no privileges required warrants attention in enterprise storage environments where iSCSI discovery is exposed.

Information disclosure via path traversal in Pagy's I18n locale handler allows an attacker to verify the existence and readability of arbitrary

Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory by uploading a file with the name '..'. Affects versions up to 2.1.4; fixed in 2.1.5. The older v1 branch (<=1.1.4) remains vulnerable with no patch. No active exploitation has been reported.

Arbitrary file read in the SpeedyCache plugin for WordPress allows authenticated administrators to read sensitive files like wp-config.php by exploiting a path traversal vulnerability in CSS URL validation. The flaw affects all versions up to 1.3.8 and requires Administrator-level access; no public exploit or active exploitation has been reported at this time.

Path traversal in Mattermost allows an admin user with SAML system-console write permissions to delete arbitrary files outside the intended directory, causing high availability impact. Affected versions include 10.11.x through 10.11.20, 11.6.x through 11.6.5, 11.7.x through 11.7.3, and 11.8.0. No public exploit is identified at time of analysis, but the required high privileges limit the immediate risk.

Quick.CMS allows authenticated administrators to read arbitrary files outside the webroot via a path traversal in HTTP URIs. An attacker with admin credentials can craft requests with ../ sequences to access sensitive sibling directories. The vendor assessed exploitation likelihood as very low and will not issue a patch.

Path traversal vulnerability in Erlang OTP's stdlib zip module allows attackers to write files outside the intended extraction directory by exploiting flawed validation of relative paths in zip archives. Affected are OTP versions 27.1 before 27.3.4.15, 28.5.0.4, and 29.0.4. Successful exploitation requires user interaction (extracting a crafted zip) and has limited impact on integrity and availability; no active exploitation has been reported.

Directory traversal in Ericsson Packet Core Controller (PCC) Configuration Management allows authenticated attackers with high privileges to alter directory permissions, causing denial of service to legitimate users. The vulnerability affects PCC versions prior to 1.39 and requires adjacent network access. No public exploit or active exploitation (KEV) has been reported, and the CVSS 4.0 medium score (4.8) reflects the limited impact and prerequisites.

Arbitrary file deletion vulnerability in Easy Digital Downloads plugin for WordPress versions 3.6.9 and earlier allows authenticated administrators to delete arbitrary files on the server via a path traversal attack. The vulnerability leads to high availability impact (file deletion) but requires high privileges, limiting exploitability to admin users. No public exploit or active exploitation has been identified at the time of analysis.

Arbitrary file deletion in the Kirki WordPress plugin (versions up to and including 6.0.13) allows an authenticated user with Editor-level privileges to delete files on the server via a path traversal flaw (CWE-22). The vulnerability is not exploitable by unauthenticated attackers, requires no victim interaction, and has no public exploit identified at time of analysis (CISA KEV: not listed, EPSS 0.33%). The impact is limited to availability, as successful exploitation can remove files but does not expose data or enable code execution, making this a moderate-priority issue.

Path traversal in ZJONSSON node-unzipper up to version 0.12.3 allows local attackers with low privileges to write files outside the intended extraction directory by crafting a malicious archive. Exploit code is publicly available, but no active exploitation has been confirmed. The vendor has not yet responded to the vulnerability report.

Path traversal in ZTE File Manager allows third-party Android apps to read sensitive files under /data/data and /data/local/tmp. The vulnerability is exposed via the FilePreViewActivity which accepts arbitrary file paths from external intents. Exploitation requires a malicious app installed on the device and user installation, but no special privileges; no evidence of active exploitation.

Path traversal vulnerability in the Phoca Commander Joomla extension allows authenticated administrators to read arbitrary files on the server via crafted save and download requests. Affected versions are 1.0.0 through 6.1.1. No active exploitation has been reported, and no public exploit code is known.

Authenticated directory traversal in Checkout Field Editor Pro for WooCommerce up to 3.7.7 enables subscriber-level attackers to read arbitrary server files. Exploitation leverages the 'thwcfe_legacy_file' parameter. No active exploitation or public exploit code is currently known, and EPSS indicates low exploitation probability.

Path traversal in Cloudreve's WOPI PUT_RELATIVE handler permits authenticated attackers with a WOPI access token to write files to arbitrary locations within the same user account, bypassing the token's single-file scope. A crafted X-WOPI-SuggestedTarget header with directory traversal sequences (e.g., a/../../evil.docx) resolves outside the source

Path traversal in pymdown-extensions' b64 extension allows remote attackers to read arbitrary image-extension files inside the configured base_path directory by injecting '../' or absolute paths in image src attributes, leading to disclosure of file contents as base64 in rendered HTML. The vulnerability affects pymdown-extensions <=10.21.3, and a publicly available proof-of-concept exists. Exploitation requires the b64 extension to be enabled and attacker-controlled Markdown input.

Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim processes a crafted dataset. A publicly available exploit exists (CVE-2026-66007), though EPSS exploitation probability is low at 0.52% and user interaction is required. Patched in commit f989ef9.

Persistent code execution via path traversal in BlenderMCP through version 0 (before commit 30a3308) allows attackers performing MITM or prompt injection to overwrite arbitrary files, such as .bashrc, by injecting traversal sequences into API response include keys. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.

Directory traversal in the Nexter Blocks WordPress plugin (all versions through 5.0.0) allows authenticated attackers holding only subscriber-level accounts to delete arbitrary JavaScript and CSS files on the server by manipulating the unsanitized 'plus_name' parameter. Successful exploitation can destroy plugin and theme asset files, causing denial of service or permanent visual breakage of affected WordPress sites. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (subscriber-level) meaningfully elevates real-world risk for multi-tenant or open-registration WordPress deployments.

Path traversal in Ne-Lexa php-zip up to version 4.0.2 allows remote attackers to write files outside the intended extraction directory by supplying a crafted entryName argument to ZipFile::extractTo(). Any PHP application that processes untrusted ZIP archives using this library is exposed to arbitrary file write at the web server's permission level. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists via a GitHub issue report, and the project maintainer has not yet responded to the disclosure, leaving all affected versions unpatched.

Path traversal in the Kubernetes Java client library's copyDirectoryFromPod function allows a compromised pod to write files to arbitrary locations on the local machine of a high-privileged operator performing copy operations. The vulnerability is only reachable when enableTarCompressing is set to false, and requires both an attacker-controlled pod and an operator actively running a copy command. With a CVSS score of 2.7 (PR:H, UI:R), no public exploit, and no CISA KEV listing, this is a narrow but credible lateral-movement vector in DevOps and CI/CD operator workflows rather than a broadly exploitable flaw.

Path traversal in HuggingFace Diffusers through 0.39.0 enables arbitrary file reads when a user or pipeline loads a maliciously crafted model. The `_get_checkpoint_shard_files` function in `hub_utils.py` blindly resolves `weight_map` shard filenames from model index JSON without validating for path separators or absolute paths, allowing an attacker who controls a model repository to escape the model directory and read any file accessible to the Diffusers process. No active exploitation confirmed (not in CISA KEV), but a public POC issue exists on GitHub and the attack surface includes the widely-used HuggingFace Hub ecosystem.

Path traversal via prompt injection in Void editor through 1.3.4 allows network attackers who can deliver malicious content into the AI agent's processing context to silently read arbitrary host files outside the open workspace, including SSH private keys and cloud credentials. The AI agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) accept absolute filesystem paths and file:// URIs without workspace confinement and bypass the built-in approval gate, enabling silent exfiltration. No CISA KEV listing exists, but a publicly available proof-of-concept exploit has been published, confirming exploitability; the AC:H rating reflects the prompt injection prerequisite rather than any technical barrier once malicious content is ingested.

Unauthenticated arbitrary file deletion in the Broadcast Live Video WordPress plugin (versions <= 7.2.4) allows any remote attacker without credentials to delete arbitrary files on the server by exploiting a path traversal flaw in the plugin's file-handling functionality. Affecting installations of the VideoWhisper live streaming plugin on WordPress, a successful attack can corrupt site integrity - including deletion of critical files such as wp-config.php, effectively bricking the WordPress installation. No public exploit code or KEV listing has been identified at time of analysis, but the zero-authentication barrier lowers the practical difficulty considerably.

Directory traversal in the WP Encryption WordPress plugin (all versions through 7.8.6.6) allows authenticated administrators to read arbitrary server files via the unsanitized 'imploded' parameter in le_admin.php, potentially exposing credentials, API keys, and configuration secrets. Beyond file-read access, the plugin's write path sanitizes output only through esc_html() - which blocks PHP tag execution but leaves plaintext files such as .htaccess fully writable, opening a secondary path to denial-of-service or malicious redirect injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Wordfence has published an upstream changeset suggesting remediation is in progress.

Directory enumeration via path traversal in the Modals Pro extension for Joomla 1.0.0–15.0.0 allows unauthenticated remote attackers to list unintended directories. Successful exploitation may expose directory structures and potentially manipulate gallery paths, though only low confidentiality and integrity impacts are reported. EPSS indicates a 0.20% exploitation probability, and no active exploitation or public exploit code is known.

Path traversal in the Cache Cleaner Pro extension for Joomla allows unauthenticated remote attackers to read and write arbitrary files outside the webroot through

Path traversal in the CDN for Joomla Pro extension for Joomla allows an attacker to check file paths outside the intended site directory via the versioning feature, exposing whether arbitrary files exist and their modification timestamps. The vulnerability has a local attack vector per its CVSS score of 6.2, indicating exploitation likely requires local access or specific configuration, and no active exploitation or public exploit code has been identified.

Directory traversal in the WCPOS - Point of Sale plugin for WooCommerce (all versions through 1.9.8) allows authenticated shop managers to read arbitrary files from the server filesystem via the REST API. The vulnerability is exploited through the 'type' parameter in template-related API endpoints, with the critical bypass condition being the inclusion of 'context=edit' in the request, which suppresses the response sanitization layer and returns raw file contents. No public exploit code has been identified at time of analysis, and exploitation requires shop manager-level credentials, limiting opportunistic attack surface.

Path traversal in boazsegev facil.io up to version 0.7.58 allows remote unauthenticated attackers to read files outside the configured web root by supplying crafted traversal sequences to the `http_sendfile2` function in the Public Folder Handler. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication and no special setup beyond a running facil.io instance with static file serving enabled. A public exploit has been released and the vendor has not responded to the responsible disclosure, leaving all known versions unpatched at time of analysis.

Path traversal via indirect prompt injection in the Ansible Lightspeed Model Context Protocol (MCP) server allows an attacker to manipulate an AI agent into writing files to unauthorized filesystem locations on the user's system. Specifically affected is the Lightspeed MCP server component; the attack leverages poisoned content processed by the agent rather than a direct network request. Successful exploitation can expose sensitive host information and enable execution of malicious commands, potentially resulting in full system compromise. No public exploit identified at time of analysis.

Path traversal in IZArc v4.6's unrar.dll component enables arbitrary file writes outside the intended extraction directory when a victim extracts a maliciously crafted RAR archive. The vulnerability stems from insufficient path validation in the RAR extraction routine, permitting an attacker-controlled archive to place files at attacker-chosen filesystem paths with the victim user's privileges. No public exploit identified at time of analysis and EPSS sits at 0.21% (11th percentile), but SSVC rates technical impact as total, reflecting the high-C/I/A CVSS score if the attack chain completes.

Cross-tenant authorization bypass in Plane's asset-management API allows any authenticated workspace member to read, delete, or duplicate file assets belonging to an entirely different workspace on the same instance, affecting all releases through 1.3.0. The API endpoints accept a workspace slug and asset ID as path parameters but perform no membership verification against the requesting user's session, returning presigned file URLs and permitting destructive operations across tenant boundaries. No public exploit has been identified at time of analysis, and EPSS exploitation probability stands at 0.15% (5th percentile), though the attack is mechanically straightforward for any authenticated user who can enumerate workspace slugs and asset IDs.

Path traversal in BuildKit's low-level build API allows crafted messages to redirect the container rootfs file-deletion action onto the real host /tmp directory, wiping its contents. All published moby/buildkit versions are affected per the broad CPE cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been identified at time of analysis; the vendor-assigned CVSS score of 3.3 (CVSS 4.0) correctly reflects a constrained impact - host /tmp destruction rather than arbitrary code execution or credential exposure.

Path traversal in the BuildKit daemon allows a client with valid control API access to craft a malicious upload request that writes files outside the BuildKit-controlled state directory, breaking container build sandbox boundaries. Affected products span all tracked versions of moby/buildkit per CPE data, and the vulnerability carries a CVSS 4.0 score of 6.9 with high integrity and availability impact on the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis.

Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read arbitrary files from the server - including wp-config.php, which contains database credentials and authentication keys - by supplying a crafted path in a form file-field that is then read and attached to a notification email. A publicly available proof-of-concept exploit exists, reported by WPScan, though the CVSS AC:H rating and SSVC Automatable:no designation indicate exploitation is not trivial. EPSS stands at 0.16% (6th percentile), and this CVE is not listed in CISA KEV, suggesting exploitation remains opportunistic rather than widespread at time of analysis.

Arbitrary file read via path traversal in FreeScout's App Logs feature exposes any server-local file readable by the PHP process to authenticated administrators prior to version 1.8.224. The bundled `rap2hpoutre/laravel-log-viewer` override decrypts a user-supplied `dl` parameter and resolves its absolute path before applying the intended `storage/logs` directory restriction, allowing the restriction to be bypassed entirely. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation could expose sensitive server files such as environment credentials or application secrets.

Sandbox path containment bypass in Network-AI's AgentRuntime (npm package `network-ai` by jovancoding) allows any low-privileged agent or user with access to `AgentRuntime.readFile()` or `AgentRuntime.listDir()` to read or enumerate files outside the configured `basePath` sandbox by targeting sibling directories whose names share the sandbox's string prefix. Versions 5.12.1 and earlier are confirmed vulnerable (CPE: cpe:2.3:a:jovancoding:network-ai:*:*:*:*:*:*:*:*, EUVD-2026-46018). A working proof-of-concept is included in the GitHub security advisory GHSA-jvcm-f35g-w78p; no public exploit confirmed in active exploitation and the vulnerability is not listed in the CISA KEV catalog.

Symlink traversal in Network-AI's EnvironmentManager.backup() allows a local attacker with write access to an environment data directory to exfiltrate arbitrary files from outside the environment root into readable backup artifacts. All Network-AI versions prior to 5.12.2 (npm package jovancoding/network-ai) are affected, confirmed in v5.12.1 per GHSA-6x2m-p4xp-wg22. A proof-of-concept is publicly available in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.

Path traversal in Network-AI's EnvironmentManager.restore() allows a local authenticated caller to copy arbitrary directories from outside the designated backups directory into any environment data directory. All versions prior to 5.12.2 (confirmed in 5.12.1) are affected, as the backupId parameter is concatenated with path.join() without containment checks, and the restore path is reachable by default through the bundled CLI. A working proof-of-concept is publicly documented in the GHSA advisory; no CISA KEV listing was identified at time of analysis.

Path traversal in the All-in-One WP Migration and Backup WordPress plugin (versions 7.87 through 7.105) allows unauthenticated network attackers to create or append log files at arbitrary filesystem locations outside the plugin's intended storage directory. A publicly available proof-of-concept exploit exists via WPScan and the SSVC framework classifies exploitation as automatable, though EPSS at 0.16% (6th percentile) indicates limited observed opportunistic activity and no CISA KEV listing confirms active exploitation at time of analysis. The constrained write capability - log file creation and appending only, not arbitrary content injection - limits direct impact, but filesystem write access outside the web root could serve as a precursor step in chained attacks depending on server permissions.

Directory traversal in FileThingie v.2.5.7 allows a remote, low-privileged attacker to read arbitrary files outside the application's intended directory boundary via a crafted HTTP request. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation with high confidentiality impact and no write or availability consequences. No confirmed active exploitation (CISA KEV) is recorded, but a public vulnerability research repository referencing this CVE exists, suggesting proof-of-concept material may be available.

Path traversal in Croogo CMS up to version 4.0.7 allows remote authenticated attackers to escape the intended file management directory by supplying crafted path sequences to the Admin File Manager's FileManager::isEditable function in FileManager/src/Utility/FileManager.php. A public proof-of-concept exploit exists and has been disclosed via a researcher advisory, while the Croogo project has not responded to the responsible disclosure report and no patch has been released. The vulnerability carries a medium base score but the combination of a public PoC, unresponsive vendor, and no remediation path meaningfully elevates practical risk for any internet-exposed Croogo instance.

Local file read via DEFINE ANALYZER in SurrealDB before versions 2.1.5 and 2.2.2 allows authenticated users holding root, namespace, or database-level privileges to point analyzer mappings at arbitrary server-side file paths, leaking file contents constrained to two-column tab-separated format. Discovered and rated Low severity during a cure53 code audit and penetration test, the flaw is a CWE-22 path traversal with no KEV listing and no public exploit identified at time of analysis. The vendor has released patches for both the 2.1.x and 2.2.x branches and introduced a SURREAL_FILE_ALLOWLIST environment variable to restrict permissible file paths.

Path traversal in Halo CMS up to version 2.24.2 allows a remotely authenticated high-privilege user to access files outside the intended backup directory via the Download function of MigrationEndpoint.java in the Files Backup Endpoint. The vulnerability is CWE-22 (Improper Limitation of a Pathname) and carries a low CVSS score of 2.0 due to the PR:H requirement, meaning exploitation is limited to users who already hold administrator-level access. A public proof-of-concept exploit exists per the provided references, though no CISA KEV listing was found at time of analysis.

Directory traversal in AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 allows an actor who can influence the MCP agent to write attacker-controlled content to arbitrary filesystem locations outside the intended workflow bundle directory via crafted workflow_files input. All pre-0.0.36 versions are affected, with the integrity-only impact (high) and no confidentiality or availability exposure confirmed by the CVSS 4.0 vector. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; Amazon has released a vendor-confirmed patch in version 0.0.36.

Arbitrary local file read in mcp-memory-keeper versions prior to 0.13.0 allows any connected MCP client or prompt-injected LLM agent to exfiltrate files readable by the server process by supplying a crafted filePath to the context_import tool. JSON files (credential files, service-account keys, other users' exported sessions) are parsed and imported into the attacker's session, then retrievable verbatim via context_get or context_export; non-JSON files (SSH keys, .env files, /etc/passwd) leak their leading bytes through a V8 SyntaxError message echoed back to the caller. No public exploit identified at time of analysis, but E2E regression tests in the fix PR confirm all three attack vectors - arbitrary JSON read, byte-leak, and ../ traversal - are reliably reproducible in affected versions.

Directory traversal via the unsanitized 'family' parameter in the Kirki plugin for WordPress (all versions up to and including 6.0.13) enables authenticated users holding editor-level access or above to delete arbitrary directories on the server filesystem, risking data loss and site unavailability. Reported by Wordfence, the flaw originates in insufficient path validation within FontService.php and GlobalDataController.php, which process the 'family' parameter without canonicalization or boundary enforcement. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the potential for irreversible filesystem destruction makes this a meaningful risk on any WordPress site granting editor access to untrusted accounts.

Directory traversal in the Ninja Forms - Excel Export WordPress plugin (versions ≤ 3.3.6) allows authenticated attackers with subscriber-level access to write .xls/.xlsx files to arbitrary server-side locations via the unsanitized 'spreadsheet_export_tmp_name' parameter. The vulnerability is a staging primitive: direct code execution is not possible through the traversal alone, but file placement in web-accessible or sensitive directories can enable follow-on attacks such as information disclosure or overwriting existing files. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Unauthenticated path traversal in Nuclio Dashboard's function build API allows arbitrary file write as root inside the Dashboard container. The `spec.handler` field accepts unsanitized module names containing `../` sequences, which Go's `path.Join`/`path.Clean` resolves to escape the build temp directory; the resulting path is passed to `os.WriteFile` running as `uid=0`. Versions up to and including 1.15.27 are affected; a full working proof-of-concept has been publicly disclosed, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Path traversal in Activepieces Enterprise Edition git-sync prior to 0.82.0 allows an authenticated project administrator to overwrite arbitrary files on the host filesystem, with potential impact ranging from data tampering and denial of service to remote code execution. Two distinct weaknesses compound each other: Git's symbolic-link handling was not disabled during repository cloning, and user-supplied identifiers - repository slug and the externalId fields for flows, tables, and connections - were concatenated into filesystem paths without sanitization of directory-traversal sequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the patch commit makes exploitation paths derivable by any skilled attacker reviewing the open-source diff.

Path traversal in FunnelKit WordPress plugin before 3.15.0.6 enables authenticated administrators to delete arbitrary .json files outside the plugin's intended directory during template-import operations. The root cause is CWE-73 (External Control of File Name or Path): the deletion handler accepts user-supplied paths without canonicalization or boundary enforcement. Leveraging CVSS scope change (S:C), a malicious admin can target configuration files belonging to other installed plugins, causing cascading denial-of-service across the WordPress installation. A publicly available exploit exists; the vulnerability is not in the CISA KEV catalog at time of analysis.

Path traversal in LogicalDOC Enterprise up to v9.1.1 allows any authenticated user to read arbitrary files outside designated directories via the OnlyOfficeEditor servlet's fileExt parameter. Exploitation requires only a low-privilege account, no special configuration, and results in high confidentiality impact - potentially exposing system credentials, configuration files, or other sensitive data. A public vulnerability disclosure exists on GitHub (netero1010), indicating exploit techniques are accessible to the public; EPSS is low (0.33%) suggesting limited observed exploitation to date.

Path traversal in nvm versions 0.32.1 through 0.40.5 allows a hostile Node.js mirror to overwrite arbitrary files in the victim's home directory, including shell startup files, leading to code execution on the next shell session. The vulnerability exists in `nvm ls-remote`, `nvm install --lts`, and any other nvm command that refreshes remote LTS aliases by fetching and parsing a mirror's `index.tab` - the LTS codename field is used as an alias filename without sanitization, permitting sequences like `../../../.bashrc` to escape `$NVM_DIR/alias`. No public exploit identified at time of analysis, but a working proof-of-concept is embedded in the upstream test suite added in the fix commit.

Path traversal in OpenWrt's cgi-io cgi-download handler (prior to 25.12.5) allows an authenticated administrator to read arbitrary root-readable files - including /etc/shadow - by exploiting a TOCTOU-style authorization flaw where ACL checks occur before path canonicalization. The rpcd session.c ACL matcher uses fnmatch() without FNM_PATHNAME, meaning a wildcard-prefixed ACL entry (e.g., /etc/config/*) can be defeated by appending ../ sequences that pass the ACL check but resolve to an out-of-scope file when open() is called. No public exploit identified at time of analysis; vendor-released patch is available in v25.12.5.

Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.

Zip-slip path traversal in File Browser 2.63.6–2.63.16 allows a low-privileged user with upload permission to plant a POSIX backslash-named file that the archive builder incorrectly normalizes into a directory traversal sequence, enabling arbitrary file write on any victim who downloads and extracts the generated archive. The root cause is the server-side conversion of `\` to `/` in archive entry names, which manufactures paths like `../../evil.sh` from the legal POSIX filename `..\..\evil.sh`. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack chain is straightforward for any user with upload access.

Path traversal in Apache Ivy's PackagerResolver (versions 2.0.0 through 2.5.3) allows an attacker with write access to a packager repository to overwrite arbitrary files outside the configured buildRoot directory by embedding '../' sequences in module coordinates such as organisation, name, or revision. The overwrite occurs during the Ant-script-driven repackaging phase that PackagerResolver triggers on artifact download. No public exploit code has been identified at time of analysis, and the vendor has released version 2.6.0 as the fix, confirmed via the Apache Ant project site on July 14, 2026.

Path traversal in F5 NGINX Agent via the config_dirs directive enables a remotely authenticated low-privileged attacker to read and write files outside of the directories designated as secure in the agent's configuration. The config_dirs directive can be set directly in the NGINX Agent configuration or through NGINX Instance Manager, expanding the attack surface across both products. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available per F5 advisory K000161971.

File path restriction bypass in n8n before 2.19.3 allows authenticated users with workflow creation or modification rights to circumvent the N8N_RESTRICT_FILE_ACCESS_TO security boundary via a legacy REST API code path, enabling arbitrary file existence disclosure on the host filesystem. Where a targeted path contains valid workflow JSON, that file can additionally be loaded and executed by the n8n engine, potentially triggering downstream actions on all systems connected to that workflow. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad impact on connected downstream systems make this a meaningful risk in multi-tenant or partially-trusted deployments.

Path traversal in mastergo-magic-mcp versions up to 0.2.0 allows local low-privileged attackers to read and write files outside the intended working directory by supplying manipulated path sequences via the `rootPath` argument of the `mcp__getComponentGenerator` component's `execute` function. A public proof-of-concept exploit has been disclosed (CVSS 4.0 E:P), and the vendor has not responded to the issue report, leaving no patch available at time of analysis. No public exploitation (CISA KEV) has been confirmed, and the local-only attack vector significantly constrains the realistic threat surface.

Path traversal (Zip Slip) in Rclone's archive extract command allows crafted archives containing `../` or `..\ ` path components in entry names to write extracted files outside the user-selected destination prefix. All Rclone versions prior to 1.74.4 are affected; an attacker who can induce a user to run `rclone archive extract` against a malicious archive can create or overwrite sibling objects in the same bucket or parent path scope. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS at 0.14% (4th percentile) reflects low real-world exploitation probability.

Path traversal in Adobe ColdFusion 2023 (up to Update 21) and ColdFusion 2025 (up to Update 10) enables a low-privileged attacker on an adjacent network to read arbitrary files outside the intended application directory, with scope change indicating access can extend beyond the ColdFusion process boundary to OS-level files. The CVSS vector (AV:A/PR:L/S:C/C:H) reflects that while high confidentiality impact is possible, exploitation is gated by both network adjacency and authenticated access, meaningfully constraining the realistic attacker pool. No public exploit identified at time of analysis; EPSS at 0.27% (19th percentile) and SSVC exploitation status of 'none' further indicate low current exploitation pressure.

Path traversal in mastergo-magic-mcp (versions 0.1 through 0.2.0) allows a locally authenticated low-privilege user to read and write arbitrary files by supplying a crafted filePath argument to the mcp__C2d component's execute function in src/tools/get-c2d.ts. A public proof-of-concept exploit has been released, though the attack surface is constrained to local access, limiting widespread exploitation. No vendor patch is available - the maintainer has not responded to the GitHub issue disclosure.

Remote code execution in the Windows DNS Server component allows an authorized, high-privileged attacker on an adjacent network to traverse outside intended directory boundaries and execute arbitrary code on the target host. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10 versions 1607 and 1809. No public exploit code exists and no active exploitation has been confirmed - CISA SSVC classifies exploitation as 'none' and EPSS sits at 0.37% (29th percentile) - however SSVC rates technical impact as 'total', consistent with the full C:H/I:H/A:H CVSS triad.

Path traversal in Microsoft Visual Studio Code (all versions from 1.0.0 up to 1.128.1) enables a locally-authenticated low-privilege attacker to bypass a file-system security boundary and read files outside a restricted directory, resulting in high confidentiality impact. The vulnerability is rated CVSS 5.5 Medium and is limited to local attack vectors, requiring PR:L authenticated access. No public exploit code or active exploitation has been identified at time of analysis; EPSS stands at 0.45% and SSVC designates exploitation status as none, making this a lower-priority remediation item despite the High confidentiality impact rating.

Path traversal in DedeCMS 5.7.118's Album Publishing Feature allows remote attackers with administrative credentials to read or write files outside the intended extraction directory by manipulating the `filename` argument passed to the `ExtractFile` function in `include/zip.class.php`. A public proof-of-concept exploit has been released on GitHub, lowering the skill bar for exploitation, though no active exploitation has been confirmed in the CISA KEV catalog. The CVSS 4.0 score of 5.1 with PR:H reflects the high privilege requirement, which materially limits the exposed attack surface to authenticated admin-level sessions.

Path traversal in openSIS Classic 9.3 exposes arbitrary server files through the legacy messaging sent-mail attachment download endpoint, exploitable by any authenticated low-privilege user. The vulnerability allows crafted sequences such as directory traversal patterns to escape the intended attachment directory and retrieve sensitive server-side files. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the low authentication bar and network accessibility make this a realistic internal threat.

Path traversal (CWE-22) in Fortinet FortiOS, FortiProxy, and FortiPAM enables a highly-privileged, physically-present attacker to execute unauthorized code or commands by escaping restricted directory boundaries. The vendor-supplied CVSS vector (AV:P/PR:H) constrains exploitation to scenarios requiring both physical device access and high-level credentials, making opportunistic or remote mass exploitation implausible. A proof-of-concept exists per the CVSS temporal indicator (E:P), and Fortinet has released an official fix per PSIRT advisory FG-IR-26-151; this vulnerability is not currently listed in the CISA KEV catalog.

Path traversal in Rockwell Automation's Studio 5000 Logix Designer allows an attacker who can deliver a crafted ACD project file to write arbitrary files to attacker-controlled locations on an engineer's workstation. The software fails to sanitize or validate embedded filenames during the ACD project-open procedure, enabling path traversal sequences to escape the intended extraction directory and potentially achieve code execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but the ICS context makes targeted file-delivery attacks via spear-phishing or shared project repositories a realistic threat vector.

Arbitrary file disclosure in Ivanti Xtraction before 2026.2.1 lets a remote, authenticated attacker traverse outside the application's web root and read sensitive files from the underlying host. The CVSS 3.1 score of 7.7 reflects a scope change (S:C), meaning the impact reaches beyond the web application into the host filesystem, though only confidentiality is affected. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; no EPSS score was provided.

Arbitrary file read in Apache OpenMeetings 5.0.0 through 9.0.x allows any room moderator to exfiltrate files accessible to the OS account running the server, including credentials and secrets, via a crafted download request to the WhiteBoard download service. The vulnerability stems from insufficient path validation in the WB download endpoint, enabling directory traversal outside the intended file scope. No active exploitation has been confirmed (not in CISA KEV), but the ability to read credential files makes this high-priority for any internet-exposed deployment where moderator access is not tightly controlled.

Symlink entries in malicious tar archives bypass the `filter_safe_tarinfos` validation in Keras 3.12.0, enabling directory escape that can read or overwrite arbitrary files on the host filesystem. The root defect is in `keras/src/utils/file_utils.py`, where `is_path_in_dir` path containment checks are applied only to regular file entries - symlink entries are extracted without equivalent validation. The exposure is most severe on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole extraction safeguard; no public exploit or active exploitation has been identified at time of analysis.

Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended workspace directory by manipulating the path argument to the `writeFile` function in the ACP ToolBridge Workspace Handler (`internal/providers/acp/tool_bridge.go`). A proof-of-concept exploit has been publicly disclosed via a GitHub issue, lowering the bar for exploitation. No CISA KEV listing indicates active widespread exploitation has not been confirmed at time of analysis.

Path traversal via the `lang` query parameter in Rejetto HFS 3.0.0 through 3.2.0 enables remote unauthenticated attackers to read JSON files outside the application's designated shared folders. Exploitation is constrained by the application's own file-loading logic - only files matching a narrow naming convention and JSON format are reachable, limiting impact to partial information disclosure rather than arbitrary file read. Vendor-released patch v3.2.1 is available; no KEV listing or confirmed public exploit exists, though the same release addresses additional higher-severity vulnerabilities noted in the release notes.

Path traversal in better-auth/better-icons (versions up to and including 1.0.5) allows a local low-privileged attacker to manipulate the icons_file argument passed to the scan_project_icons/sync_icon component, escaping the intended directory boundary to read or write arbitrary files accessible to the process. A public proof-of-concept has been disclosed via GitHub issue #18, and the vendor has not yet responded to the responsible disclosure. No CISA KEV listing exists; the CVSS 4.0 base score of 1.9 correctly reflects the constrained local-only attack surface and limited per-file impact.

Path traversal in augmnt augments-mcp-server 7.1.0 allows a local low-privileged attacker to read arbitrary files outside the intended project directory by manipulating the packageJsonPath argument passed to the scanProjectDeps function. The vulnerability is limited to confidentiality impact (VC:L) with no integrity or availability effect, and a proof-of-concept has been publicly disclosed via a GitHub issue. The vendor has not responded to the responsible disclosure report, meaning no patch is currently available.

Path traversal in alioshr memory-bank-mcp through versions 0.2.1 and 3.1 allows a local low-privileged user to read files outside the intended project directory boundary by supplying traversal sequences in the `projectName` argument processed by `list-project-files-validation-factory.ts`. A public proof-of-concept has been disclosed via GitHub issue #36, and no patch is available as the vendor has not yet responded to the coordinated disclosure. No confirmed active exploitation has been identified (not listed in CISA KEV), though the public exploit lowers the barrier for opportunistic local abuse.

Path traversal in tugcantopaloglu godot-mcp 2.0.0 allows a local low-privileged user to escape the intended project directory by manipulating the projectPath argument passed to the validatePath function within the run_project component. A public proof-of-concept has been disclosed via GitHub issue #9, raising practical exploitability above the raw CVSS score of 4.8 would suggest. No active exploitation is confirmed by CISA KEV; a vendor-released patch is available in version 3.0.0.

Path traversal in makafeli n8n-workflow-builder (versions up to 0.11.0) allows a local low-privileged attacker to manipulate the filePath argument in the update_node_from_file function within build/server.cjs, enabling arbitrary file reads and writes outside the intended directory scope. A publicly available proof-of-concept exists on GitHub (issue #28), and the vendor has not responded to the coordinated disclosure. No public exploit has been confirmed as actively exploited and it is not listed in CISA KEV, but the local requirement combined with POC availability makes this a credible insider or post-compromise risk.

Path traversal in PraisonAI before 4.6.78 enables file exfiltration outside the workspace by embedding traversal sequences (e.g., @../outside_secret.txt) or absolute paths in custom project command templates, which are then injected verbatim into model prompts. Users who process attacker-controlled command files expose all process-readable files - including credentials, environment variables, and application secrets - to whoever controls the model interaction. No public exploit code has been identified and PraisonAI is not listed in the CISA KEV catalog at time of analysis; a vendor patch is available.

Arbitrary file read in the UnderConstructionPage PRO WordPress plugin (≤ 5.76) exposes sensitive server files to any authenticated subscriber-level user. The plugin's template_thumbnail parameter accepts unsanitized local file paths and copies their contents into the publicly accessible uploads directory, making the exfiltrated data retrievable by unauthenticated third parties after the fact. No public exploit code or CISA KEV listing exists at time of analysis; however, the low privilege bar (subscriber accounts) and high confidentiality impact (CVSS C:H) make this a meaningful risk on multi-user WordPress installations.