CWE-24
AllowedPath Traversal: '../filedir'
Abstraction: Variant · Status: Incomplete
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.
197 vulnerabilities reference this CWE, most recent first.
GHSA-33GW-PVGJ-248F
Vulnerability from github – Published: 2023-12-21 21:30 – Updated: 2023-12-21 21:30A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of the file /file-manager/rename.php. The manipulation of the argument oldName leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248689 was assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-7040"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-21T20:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of the file /file-manager/rename.php. The manipulation of the argument oldName leads to path traversal: \u0027../filedir\u0027. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248689 was assigned to this vulnerability.",
"id": "GHSA-33gw-pvgj-248f",
"modified": "2023-12-21T21:30:31Z",
"published": "2023-12-21T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7040"
},
{
"type": "WEB",
"url": "https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20read.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.248689"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.248689"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3M3J-G6JR-6C5M
Vulnerability from github – Published: 2024-04-12 15:37 – Updated: 2024-04-12 15:37A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-3686"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-12T14:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: \u0027../filedir\u0027. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-3m3j-g6jr-6c5m",
"modified": "2024-04-12T15:37:21Z",
"published": "2024-04-12T15:37:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3686"
},
{
"type": "WEB",
"url": "https://github.com/Echosssy/CVE/blob/main/Dedecms%E6%9C%80%E6%96%B0%E7%89%88%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E7%BB%95%E8%BF%87.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.260473"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.260473"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.309454"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3RXX-HFRV-77FV
Vulnerability from github – Published: 2024-03-17 12:30 – Updated: 2024-03-17 12:30A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-2563"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-17T12:15:07Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: \u0027../filedir\u0027. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability.",
"id": "GHSA-3rxx-hfrv-77fv",
"modified": "2024-03-17T12:30:38Z",
"published": "2024-03-17T12:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2563"
},
{
"type": "WEB",
"url": "https://github.com/PandaXGO/PandaX/pull/3"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.257062"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.257062"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4C38-FQQV-56CM
Vulnerability from github – Published: 2025-10-01 21:31 – Updated: 2025-10-01 21:31Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.
{
"affected": [],
"aliases": [
"CVE-2025-61188"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-01T20:18:38Z",
"severity": "MODERATE"
},
"details": "Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.",
"id": "GHSA-4c38-fqqv-56cm",
"modified": "2025-10-01T21:31:23Z",
"published": "2025-10-01T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61188"
},
{
"type": "WEB",
"url": "https://github.com/jeecgboot/JeecgBoot/issues/8826"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4F3P-5VQ4-2R5C
Vulnerability from github – Published: 2022-08-11 00:00 – Updated: 2022-08-16 00:00A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an unauthenticated remote attacker to upload arbitrary files to the SMS host.
{
"affected": [],
"aliases": [
"CVE-2022-38129"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-10T20:16:00Z",
"severity": "CRITICAL"
},
"details": "A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an unauthenticated remote attacker to upload arbitrary files to the SMS host.",
"id": "GHSA-4f3p-5vq4-2r5c",
"modified": "2022-08-16T00:00:25Z",
"published": "2022-08-11T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38129"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2022-28"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4R29-3QQ2-W2VW
Vulnerability from github – Published: 2025-12-08 18:30 – Updated: 2025-12-08 21:30Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.
{
"affected": [],
"aliases": [
"CVE-2025-61318"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-08T16:15:52Z",
"severity": "MODERATE"
},
"details": "Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.",
"id": "GHSA-4r29-3qq2-w2vw",
"modified": "2025-12-08T21:30:19Z",
"published": "2025-12-08T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61318"
},
{
"type": "WEB",
"url": "https://github.com/AndyNull/em/blob/main/emlog%20pro%20-%20del%20vuln.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4WJ3-6RQ6-HRW7
Vulnerability from github – Published: 2023-08-05 21:30 – Updated: 2023-08-05 21:30A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file \Service\FileDownload.ashx. The manipulation of the argument Files leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-236206 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-4171"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-05T21:15:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file \\Service\\FileDownload.ashx. The manipulation of the argument Files leads to path traversal: \u0027../filedir\u0027. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-236206 is the identifier assigned to this vulnerability.",
"id": "GHSA-4wj3-6rq6-hrw7",
"modified": "2023-08-05T21:30:19Z",
"published": "2023-08-05T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4171"
},
{
"type": "WEB",
"url": "https://github.com/nagenanhai/cve/blob/main/duqu.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.236206"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.236206"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-56G6-5G9J-WJC3
Vulnerability from github – Published: 2025-04-26 15:30 – Updated: 2025-04-26 15:30In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.
{
"affected": [],
"aliases": [
"CVE-2025-46646"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-26T15:15:45Z",
"severity": "MODERATE"
},
"details": "In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.",
"id": "GHSA-56g6-5g9j-wjc3",
"modified": "2025-04-26T15:30:31Z",
"published": "2025-04-26T15:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46646"
},
{
"type": "WEB",
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=708311"
},
{
"type": "WEB",
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f14ea81e6c3d2f51593f23cdf13c4679a18f1a3f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-56R4-VJ3R-H3VV
Vulnerability from github – Published: 2025-04-20 03:50 – Updated: 2025-04-28 15:31GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter.
{
"affected": [],
"aliases": [
"CVE-2025-43919"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-20T01:15:45Z",
"severity": "MODERATE"
},
"details": "GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter.",
"id": "GHSA-56r4-vj3r-h3vv",
"modified": "2025-04-28T15:31:38Z",
"published": "2025-04-20T03:50:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43919"
},
{
"type": "WEB",
"url": "https://code.launchpad.net/~mailman-coders/mailman/2.1"
},
{
"type": "WEB",
"url": "https://github.com/0NYX-MY7H/CVE-2025-43919"
},
{
"type": "WEB",
"url": "https://github.com/cpanel/mailman2-python3"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2025/04/21/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5CGX-VHFP-6CF9
Vulnerability from github – Published: 2022-02-15 01:57 – Updated: 2023-10-02 11:38Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.
Specific Go Packages Affected
sigs.k8s.io/secrets-store-csi-driver/controllers sigs.k8s.io/secrets-store-csi-driver/pkg/rotation sigs.k8s.io/secrets-store-csi-driver/pkg/secrets-store
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "sigs.k8s.io/secrets-store-csi-driver"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.15"
},
{
"fixed": "0.0.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-8568"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-22",
"CWE-24"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-12T21:44:15Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a `SecretProviderClassPodStatus/Status` resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under `var/lib/kubelet/pods` that contain other Kubernetes Secrets.\n\n### Specific Go Packages Affected\nsigs.k8s.io/secrets-store-csi-driver/controllers\nsigs.k8s.io/secrets-store-csi-driver/pkg/rotation\nsigs.k8s.io/secrets-store-csi-driver/pkg/secrets-store",
"id": "GHSA-5cgx-vhfp-6cf9",
"modified": "2023-10-02T11:38:19Z",
"published": "2022-02-15T01:57:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8568"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/378"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/pull/371"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/commit/c2cbb19e2eef16638fa0523383788a4bc22231fd"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/Cb9cvymTzl4"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0629"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Directory traversal in Kubernetes Secrets Store CSI Driver"
}
Mitigation MIT-5.1
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
- Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
No CAPEC attack patterns related to this CWE.