Path Traversal

A vulnerability was identified in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability was found in code-projects Email Logging Interface 2.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22) that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary external content. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

IQ-Support developed by IQ Service International has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

JVC VN-T IP-camera models firmware versions up to 2016-08-22 (confirmed on the VN-T216VPRU model) contain a directory traversal vulnerability in the checkcgi endpoint that accepts a user-controlled. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

N-central < 2025.4 is vulnerable to authentication bypass via path traversal. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.

Improper Limitation of a Pathname 'Path Traversal') vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.

Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized attacker to elevate privileges over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. Rated high severity (CVSS 8.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. Rated high severity (CVSS 8.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. Rated medium severity (CVSS 6.4). No vendor patch available.

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.

PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within the web-based DICOM viewer component. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission to execute arbitrary shell commands when. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The CYAN Backup plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' functionality in all versions up to, and including, 2.5.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVAT is an open source interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GE Vernova Smallworld on Windows, Linux allows File Manipulation.3.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

AstrBot Project v3.5.22 contains a directory traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A relative path traversal vulnerability has been reported to affect QuMagie. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A relative path traversal vulnerability has been reported to affect Download Station. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A path traversal vulnerability has been reported to affect Qsync Central. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

archives is a Go library for extracting archives (tar, zip, etc.). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Dosage is a comic strip downloader and archiver. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 26.7% and no vendor patch available.

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Path traversal in Download Counter WordPress plugin through version 1.4 allows unauthenticated remote attackers to read arbitrary files from the web server. The vulnerability enables confidentiality breach through directory traversal sequences. EPSS score of 0.09% indicates low observed exploitation probability. No active exploitation confirmed via CISA KEV, though Patchstack database listing suggests security researcher awareness and potential for weaponization.

Path Traversal: '.../...//' vulnerability in Dmitry V. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Path traversal in Blanka WordPress theme versions before 1.5 enables unauthenticated remote attackers to include arbitrary PHP files from the server filesystem via malformed directory sequences ('.../...//'). Despite high CVSS 8.1, real-world exploitation requires specific server conditions (attack complexity high). EPSS score of 0.07% (20th percentile) indicates low observed exploitation likelihood. No CISA KEV listing or public POC identified at time of analysis, suggesting limited active targeting despite theoretical severity.

Path traversal vulnerability in Wanderland WordPress theme versions ≤1.7.1 enables remote unauthenticated PHP local file inclusion through crafted '.../...//' patterns. Successful exploitation allows reading arbitrary PHP files on the server, potentially exposing database credentials, configuration secrets, or achieving remote code execution if writable paths exist. EPSS score of 0.05% (17th percentile) indicates relatively low probability of mass exploitation, and no evidence of active exploitation in CISA KEV. Attack complexity is rated High (AC:H), suggesting exploitation requires specific timing, configuration conditions, or race conditions despite the remote unauthenticated attack vector.

Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.17.0. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Cursor is a code editor built for programming with AI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Cursor is a code editor built for programming with AI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The ShopLentor - WooCommerce Builder for Elementor & Gutenberg +21 Modules - All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A parsing issue in the handling of directory paths was addressed with improved path validation. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Path traversal in Apache Tomcat versions 9.x through 11.x allows authenticated attackers to bypass security constraints protecting /WEB-INF/ and /META-INF/ directories when URL rewriting rules manipulate query parameters. Successful exploitation combined with enabled PUT requests enables remote code execution through malicious file upload. Apache Security Team confirms publicly available exploit code exists. The vulnerability stems from a regression in the fix for bug 60013, where URL normalization occurs before decoding, creating an exploitable window in specific rewrite configurations.

Path traversal vulnerability in OpenWGA 7.11.12 Build 737 TMLScript API WGA.File component allows high-privileged remote attackers to manipulate file paths and access unauthorized resources. The vulnerability has publicly available exploit code and an extremely low EPSS score (0.07%, percentile 22%), suggesting limited real-world exploitation despite network accessibility, likely due to the requirement for high-level authentication that restricts practical attack surface.

Path traversal in givanz Vvveb up to 1.0.7.3 allows authenticated remote attackers to manipulate the File argument in the Code Editor's sanitizeFileName function, enabling unauthorized file system access with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS score of 0.05% suggests limited real-world exploitation despite the availability of proof-of-concept.

Arbitrary file deletion in ThimPress WP Pipes plugin for WordPress (up to version 1.4.3) allows unauthenticated attackers to delete arbitrary files on the server via path traversal. This network-based, high-severity vulnerability (CVSS 8.6) has a low EPSS exploitation probability (0.09%) and is not listed in CISA KEV, with no known public exploit code at time of analysis.

Arbitrary file deletion in PT Luxa Addons WordPress plugin versions ≤1.2.2 allows authenticated attackers with low privileges (e.g., subscriber) to delete arbitrary files on the server via path traversal, leading to denial of service. The vulnerability is remotely exploitable but requires an authenticated account; no public exploit or active exploitation has been observed at this time, and EPSS indicates a very low exploitation probability (0.06%).

We are tasked with producing a comprehensive JSON analysis. The input provides CVE ID, description, CVSS vector, CWE, and some multi-source intel: EPSS score (0.07%, percentile 22%), tags "Path Traversal", and a reference to Patchstack. There is no KEV listing, no explicit POC availability, no patch version stated beyond "through <= 3.3.5", meaning affected versions up to 3.3.5. The reference URL is a Patchstack advisory. Let's read the URL content? Not provided directly but the advisory likely describes the vulnerability. Since we only have the description, we need to synthesize using all data: CVE description, CVSS vector, EPSS, tags, reference. There is no CPE string, but the product is "Workreap (theme's plugin) workreap" from AmentoTech. It is a WordPress theme plugin. The CVSS vector: AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. So attack vector Network, low complexity, privileges required Low, no user interaction, scope changed, confidentiality none, integrity none, availability high. That suggests a path traversal leading to availability impact (file deletion maybe? The Patchstack URL says "arbitrary-file-deletion-vulnerability", confirming impact: arbitrary file deletion via path traversal. The CWE-22 path traversal. Now, we need to produce fields. Let's start. product_name: "Workreap" (1-3 words, the specific product name). So "Workreap" is the theme's plugin. Could be "Workreap plugin" but only 1-3 words, so "Workreap". If "Workreap (theme's plugin)" that's more than 3 words, but "Workreap" alone is fine. summary: synthesize: Path traversal vulnerability in Workreap plugin for WordPress (theme's plugin) through version 3.3.5 allows authenticated attackers (PR:L) to delete arbitrary files on the server, causing denial of service (A:H). No confidentiality or integrity impact, but high availability impact. EPSS 0.07% indicates low exploit likelihood. No KEV listing. Not mention of active exploitation. So: "Authenticated attackers can exploit a path traversal vulnerability in Workreap plugin versions <= 3.3.5 to delete arbitrary files, resulting in denial of service. The vulnerability has a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating network-based low-complexity attack with no user interaction beyond authentication. EPSS score of 0.07% suggests low probability of exploitation in the wild, and no evidence of active exploitation is available." That's a good summary. technical_context: Mention underlying technology: WordPress plugin, path traversal due to improper sanitization of user-supplied input in file operations. CWE-22. Product Workreap by AmentoTech, a theme plugin. CPE data not provided, but we can infer CPES: likely cpe:2.3:a:amentotech:workreap:... The reference Patchstack advisory shows the plugin slug "workreap". The vulnerability leads to arbitrary file deletion. The affected product is the Workreap plugin. So technical_context: "The Workreap plugin is a WordPress theme companion plugin that likely handles file uploads or paths, where insufficient sanitization allows a path traversal attack (CWE-22). An attacker with low-privilege user access can manipulate file paths to traverse directories, potentially deleting files outside the intended directory. The CVSS vector confirms network attack vector, low attack complexity, and no user interaction required after authentication." risk_assessment: Use CVSS vector: Network, low complexity, low privileges, no UI, scope changed, no CIA except A:H. So a low-privileged (e.g., subscriber) user can cause denial of service by deleting files. EPSS 0.07% (low probability). No KEV, no POC mentioned. SSVC decision might be: exploitation none, automatable yes (network, low complexity), technical impact partial (availability only), so priority might be lower. So risk is moderate: high CVSS but low EPSS suggests while the impact is serious, exploitation is not widespread or likely. "Risk is moderate: CVSS 7.7 indicates a critical availability impact, but the EPSS score of 0.07% (22nd percentile) suggests very low probability of real-world exploitation. No active exploitation or publicly available exploit code is reported. The attack requires authenticated access (low privileges), which reduces the attack surface slightly. However, the low complexity and network vector make it automatable once authenticated." affected_products: "Workreap plugin for WordPress versions n/a through 3.3.5. The vendor is AmentoTech. For details, see Patchstack advisory: https://patchstack.com/database/Wordpress/Plugin/workreap/vulnerability/wordpress-workreap-theme-s-plugin-plugin-3-3-5-arbitrary-file-deletion-vulnerability?_s_id=cve" That's concise. remediation: There's no patch information in input other than "through <= 3.3.5", implying that versions up to 3.3.5 are affected. Typically, a fix would be in a later version, but the advisory might not specify. The Patchstack URL might have remediation. Since we don't have the content, we must rely on the description: "through <=3.3.5" so fix likely in version after 3.3.5. We should state: "Upgrade Workreap plugin to a patched version later than 3.3.5. If no update is available, consider disabling the plugin or restricting file access permissions on the server to limit impact. Monitor the vendor’s release page and Patchstack advisory for updates." However, we can't confirm a specific version. So: "No patched version is specified in the available data; however, versions up to 3.3.5 are affected. Immediately update to a version newer than 3.3.5 when released, or disable the plugin until a fix is available. As a compensating control, restrict the web server process's write permissions to critical directories, though this may affect plugin functionality. Refer to the Patchstack advisory for official remediation." exploit_scenario: "An authenticated user, such as a subscriber, sends a malicious request with a crafted file path parameter to a vulnerable endpoint in the Workreap plugin, leveraging path traversal sequences (e.g., "../") to specify a target file outside the intended directory. The application processes the path without proper sanitization, resulting in deletion of that file and causing service disruption." That's realistic. No POC noted, so no mention. exploitation_conditions: Need to extract specific conditions from description. The description says: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal." So the vulnerability exists when the plugin processes file paths (likely during file deletion operations). The CVSS says PR:L, so attacker must have low privileges (authenticated as subscriber or similar). No user interaction. So conditions: "The attacker must have a low-privilege user account on the WordPress site (authenticated). The Workreap plugin must be active and the vulnerable endpoint accessible. No special feature needs to be enabled beyond the plugin's normal operation. Exploitation does not require user interaction." That's it. attack_chain: We'll craft a chain: "Authenticate to WordPress as low-privilege user → Craft malicious request with path traversal payload targeting sensitive file → Send request to vulnerable Workreap endpoint → Plugin processes path without sanitization → File at traversed path is deleted → Service disruption (denial of service due to missing critical file)." confidence_notes: "Exploitation conditions derived from CVSS vector (PR:L) and Patchstack advisory. No public exploit availability confirmed. No CISA KEV listing. EPSS suggests low exploitation likelihood. Patch availability not specified in the input; update guidance inferred from affected version range." prevalence: "medium" - Workreap is a WordPress theme plugin, probably used by some websites but not as ubiquitous as core plugins. Could be low? But I'd estimate medium: WordPress plugin usage is common, but it's a theme-specific plugin, not a general-purpose plugin. So "low" might be more accurate. However, we need to be real: theme companion plugins can have decent install base. But without stats, I'd say "medium" is safe. Prevalence basis: "WordPress theme companion plugin used with Workreap theme". So "medium" because it's not a top plugin but tied to a commercial theme. I'll put prevalence "low"? Let's see input: no install numbers. I'll gauge: "AmentoTech Workreap" theme's plugin. ThemeForest maybe. I'll check: "workreap" theme on ThemeForest has ~3,000 sales? That might be low. So prevalence "low". Prevalence basis: "commercial WordPress theme plugin with limited install base". So prevalence: "low". If unknown, we could say unknown, but we can estimate. I'll go with "low". Prevalence basis: "specialized commercial theme companion plugin, not widely deployed". assessed_cvss_vector: My own independent CVSS. The given vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. I need to output my own assessment. It seems accurate: network attack vector, low complexity, privileges low, no user interaction, scope changed because the vulnerable component is the plugin and the impact is on the file system? Actually, scope changed because the vulnerable component (plugin) impacts a resource outside its scope (other files on server). S:C is appropriate. Impact: confidentiality none (C:N), integrity none (I:N), availability high (A:H). So I'd output the same vector. Rationale: "Authenticated low-privilege user can delete arbitrary files, causing availability impact; no confidentiality or integrity loss." So vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H". For CVSS 4.0: I need to map. CVSS 4.0 base vector: AV:N, AC:L, AT:N (no attack requirement specified), PR:L, UI:N, VC:N, VI:N, VA:H (vulnerable system availability high), SC:N, SI:N, SA:N (subsequent system? The scope changed in 3.1 is handled differently in 4.0. In CVSS 4.0, if there is a scope change, the impact to the subsequent system (the one whose security relies on the vulnerable component) is denoted by SC, SI, SA. The vulnerable system itself is the plugin component, which has VC, VI, VA. Since the vulnerability only deletes files (affect the system's availability), VA:H. The subsequent system (the filesystem) is the same host, but the scope is changed: the vulnerable component is the plugin and the impact is on the server files. In CVSS 4.0, scope is not explicitly captured the same way; instead, we have vulnerable system metrics and subsequent system metrics. The attacker's action affects the vulnerable component with VA:H (availability of the plugin? Actually, the file deletion impacts the server's availability, not the plugin's availability. But CVSS 4.0 definition: "Vulnerable System metrics refer to the system that contains the vulnerable component and is most directly impacted by the vulnerability." The plugin is the vulnerable component, and the system hosting it is the vulnerable system. The availability impact on that system is high (server files deleted, causing DoS). So VC:N, VI:N, VA:H. No subsequent system impact because the vulnerability directly affects the vulnerable system. So SC, SI, SA are N. So CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. That seems right. The 3.1 scope change translates to a CVSS 4.0 situation where the vulnerable system is the server (the component is the plugin), and there is no subsequent system. Actually, in 3.1 scope changed because the component (plugin) is separate from the impacted resource (files). In 4.0, that's captured by the fact that the vulnerable system is the server, and the vulnerability impacts the server's availability. So no subsequent system. So vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. Good. assessed_cvss_rationale: "Authenticated low-privileged network attack requires no user interaction, targeting file deletion causing high availability impact, no confidentiality or integrity loss." assessed_cvss40_vector: as above. Now, all fields must be plain text

Arbitrary file deletion in the Taskbot WordPress plugin through version 6.4 allows authenticated low-privilege users to delete critical files via path traversal, leading to denial of service. No active exploitation or public exploit is reported; EPSS score is low (0.07%).

Path traversal in e107 CMS up to version 2.3.3 allows authenticated remote attackers to manipulate the multiaction[] parameter in the Avatar Handler (/e107_admin/image.php) to access or modify arbitrary files on the server. The vulnerability requires valid user credentials but has low CVSS impact (2.1) and extremely low exploitation probability (EPSS 0.11%), though publicly available exploit code exists and the vendor has not provided a response or patch.

Path traversal in ChurchCRM's Backup Restore Handler allows high-privileged remote attackers to manipulate the restoreFile argument and access arbitrary files on the system. The vulnerability affects ChurchCRM up to version 5.18.0, requires administrative privileges (PR:H), and has publicly available exploit code. While CVSS score is low (2.0) due to privilege requirements, the limited scope impact and vendor non-response elevate practical risk for deployments with exposed admin interfaces.

Path traversal in Streamax Crocus 1.3.40 allows authenticated remote attackers to read arbitrary files via manipulation of the FilePath parameter in the /DeviceFileReport.do?Action=Download endpoint. The vulnerability has publicly available exploit code and affects the file download functionality with low confidentiality impact. Despite a CVSS score of 2.1, the vendor has not responded to disclosure and the exploit is publicly weaponized.

Path traversal in Streamax Crocus 1.3.40 Download function allows authenticated remote attackers to read arbitrary files via manipulation of the Path parameter in /Service.do?Action=Download requests. The vulnerability has a low CVSS score (2.1) due to requirement for authenticated access and confidentiality-only impact, but publicly available exploit code exists and the vendor has not responded to disclosure efforts.

Arbitrary file read and resource exhaustion in the mammoth document conversion library (all language editions: JS, Python, Java, .NET) affects versions 0.3.25 through 1.10.x. When converting a crafted .docx file whose images reference external URIs via the `r:link` attribute, mammoth resolves those URIs to host filesystem paths, reads the file, and embeds the content as a base64 data URI in the HTML output - exposing the contents of any file readable by the conversion process to whoever receives the HTML. A second vector allows denial-of-service by linking to character device files such as `/dev/zero`. A proof-of-concept exists (linked Gist), but no confirmed active exploitation is recorded in CISA KEV.

PHP object injection in Vfront 0.99.52's mexcel.php endpoint exposes an unauthenticated POST parameter directly to unserialize() without class restrictions, enabling remote attackers to instantiate arbitrary PHP objects. Depending on exploitable gadget chains present in the Vfront codebase or its PHP dependencies, this can escalate to remote code execution, SQL injection, path traversal, or denial of service. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.40% (32nd percentile), consistent with the absence of a CISA KEV listing.

Path traversal in RainyGao DocSys up to version 2.02.36 allows authenticated remote attackers to manipulate the path argument in the /Doc/deleteDoc.do endpoint, enabling deletion or access to arbitrary files outside the intended directory. The vulnerability has been publicly disclosed with exploit code available on GitHub, though the vendor has not responded to early disclosure notifications. EPSS exploitation probability is low at 0.11%, and no active exploitation in CISA KEV has been reported.

Path traversal in RainyGao DocSys up to version 2.02.36 allows authenticated remote attackers to manipulate the 'path' parameter in the updateRealDoc function (/Doc/uploadDoc.do) to write files outside intended directories. The vulnerability affects the file upload component and has publicly available exploit code, though the low CVSS score (2.1) and minimal EPSS (0.12%) indicate limited real-world impact despite confirmed public exploitability.

Path traversal vulnerability in MoneyPrinterTurbo up to version 1.2.6 allows authenticated remote attackers to manipulate file upload parameters in the music API endpoint, enabling arbitrary file write operations with limited confidentiality and integrity impact. Publicly available exploit code exists and the vulnerability has low EPSS exploitation probability (0.09%, 26th percentile), suggesting limited real-world weaponization despite proof-of-concept availability.

Directory traversal in the Error Log Viewer plugin for WordPress (versions up to 1.1.6) allows authenticated administrators to read arbitrary files on the server via the rrrlgvwr_get_file function. The vulnerability is rooted in insufficient path validation (CWE-22) and has a CVSS score of 4.9 due to high confidentiality impact but limited scope (administrator privilege requirement). No public exploit code or active exploitation has been identified at the time of analysis.

Cross-site scripting (XSS) in Nozomi Networks CMC and Guardian web management interface allows authenticated users with limited privileges to craft a malicious URL that, when visited by another authenticated user, executes arbitrary JavaScript. No public exploit or active exploitation has been reported, and the EPSS exploitation probability is low (0.03%).

Path traversal in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0076-000 Ver 4.00) exposes sensitive files to authenticated network attackers. The flaw resides in the device's web interface, where insufficiently validated path input allows an attacker to escape the intended directory root and read arbitrary files from the underlying filesystem. No public exploit code or active exploitation has been confirmed at time of analysis, but a third-party security researcher advisory exists at xdiv-sec.github.io detailing the issue.

Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vulnerable to a Directory Traversal attack that results in the disclosure of directory listings. The code contains a security check to prevent path traversal for reading file contents, but this check is effectively bypassed by subsequent logic that attempts to find directory suggestions. An attacker can leverage this flaw to list the contents of arbitrary directories on the user's filesystem, including the user's home directory, exposing sensitive information about the file system's structure. This issue is fixed in version 0.13.20.

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later

Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file inclusion attacks which can lead to leakage of passwords or any file on the file system including the Traccar configuration file. Versions 5.8 - 6.0 are only vulnerable if <entry key='web.override'>./override</entry> is set in the configuration file. Versions 6.1 - 6.8.1 are vulnerable by default as the web override is enabled by default. The vulnerable code is removed in version 6.9.0.

Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” parameter in “/lib/asp/DOCSAVEASASP.ASP”.

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFlow allows Path Traversal, Accessing Functionality Not Properly Constrained by ACLs.This issue affects ChangeFlow: from All versions through v9.0.1.1.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All versions to v9.0.1.1.

An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects SafePC Enterprise: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, and V5.*.*.

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.

auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. The vulnerability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.0-8.16.0) or indirectly relies on those versions through the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs. This issue is fixed in version 8.17.0.

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.