Skip to content
Noroxi

CWE-22 · 10,715 records

Path traversal

Why does it happen?

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

How to prevent it

  1. 01After resolving the path, verify it stays within the root directory.
  2. 02Serve files by database ID rather than by name.
  3. 03Run the server process with read access only to the directories it needs.

Vulnerable and fixed code

A representative teaching example. Highlighted lines mark where the bug and the fix are.

Vulnerable

ts
const file = path.join(ROOT, req.query.name);res.sendFile(file);

Fixed

ts
const file = path.resolve(ROOT, req.query.name);if (!file.startsWith(ROOT + path.sep)) {  return res.sendStatus(400);}res.sendFile(file);

Is this pattern in your code?

We look for this class specifically as part of our Web and API penetration testing service. Findings are delivered with line numbers.

Web and API penetration testingRequest a quote

CVEs in this class

10,000 records

  • CVE-2019-11510
    100Now

    In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attack

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    ivanti · connect secureMay 8, 2019

  • CVE-2020-5902
    99Now

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Inte

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    f5 · big-ip access policy managerJul 1, 2020

  • CVE-2022-29464
    99Now

    Certain WSO2 products allow unrestricted file upload with resultant remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    wso2 · api managerApr 18, 2022

  • CVE-2024-23897
    99Now

    Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character follo

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    jenkins · jenkinsJan 24, 2024

  • CVE-2018-13379
    99Now

    An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    fortinet · fortiproxyJun 4, 2019

  • CVE-2019-19781
    99Now

    An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    citrix · application delivery controller firmwareDec 27, 2019

  • CVE-2021-22005
    99Now

    The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · cloud foundationSep 23, 2021

  • CVE-2021-41773
    99Now

    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · http serverOct 5, 2021

  • CVE-2021-20090
    99Now

    A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <=

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    buffalo · wsr-2533dhpl2-bk firmwareApr 29, 2021

  • CVE-2021-42013
    99Now

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · http serverOct 7, 2021

  • CVE-2024-32113
    99Now

    Apache OFBiz: Path traversal leading to RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · ofbizMay 8, 2024

  • CVE-2019-3396
    99Now

    The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.1

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    atlassian · confluence serverMar 25, 2019

  • CVE-2021-21972
    99Now

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · cloud foundationFeb 24, 2021

  • CVE-2010-2861
    99Now

    Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to re

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · coldfusionAug 11, 2010

  • CVE-2024-4885
    99Now

    WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    progress · whatsup goldJun 25, 2024

  • CVE-2019-16278
    99Now

    Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a c

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    nazgul · nostromo nhttpdOct 14, 2019

  • CVE-2023-47246
    99Now

    In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    sysaid · sysaidNov 10, 2023

  • CVE-2026-85706
    99Now

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

    CriticalCVSS 10.0KEVWeaponizedEPSS 97%

    gitlab · gitlabSep 11, 2026

  • CVE-2022-41352
    98Now

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0.

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    synacor · zimbra collaboration suiteSep 25, 2022

  • CVE-2022-37042
    97Now

    Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    synacor · zimbra collaboration suiteAug 12, 2022

  • CVE-2024-7399
    97Now

    Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attack

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    samsung · magicinfo 9 serverAug 12, 2024

  • CVE-2024-8963
    96Now

    Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

    CriticalCVSS 9.1KEVWeaponizedEPSS 98%

    ivanti · endpoint manager cloud services applianceSep 19, 2024

  • CVE-2025-34028
    96Now

    Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

    CriticalCVSS 9.3KEVWeaponizedEPSS 97%

    commvault · commvaultApr 22, 2025

  • CVE-2026-93616
    96Now

    Directory Traversal and File upload allows execution of arbitrary script on the Management Server

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    checkpoint · multi-domain security managementSep 22, 2026

  • CVE-2019-7195
    96Now

    This external control of file name or path vulnerability allows remote attackers to access or modify system files.

    CriticalCVSS 9.8KEVWeaponizedEPSS 89%

    qnap · photo stationDec 5, 2019

All vulnerability classes