Common Weakness Enumeration

CWE-24

Allowed

Path Traversal: '../filedir'

Abstraction: Variant · Status: Incomplete

API response cwe.mitre.org

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

212 vulnerabilities reference this CWE, most recent first.

GHSA-VMQV-3858-9WP7

Vulnerability from github – Published: 2025-04-26 15:30 – Updated: 2025-12-12 18:30
VLAI
Details

An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbitrary code via ../ in the filePath parameter.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-53636"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-24"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-26T15:15:44Z",
    "severity": "MODERATE"
  },
  "details": "An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbitrary code via ../ in the filePath parameter.",
  "id": "GHSA-vmqv-3858-9wp7",
  "modified": "2025-12-12T18:30:27Z",
  "published": "2025-04-26T15:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53636"
    },
    {
      "type": "WEB",
      "url": "https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-53636"
    },
    {
      "type": "WEB",
      "url": "https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2024-53636"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VMR6-G39X-QP82

Vulnerability from github – Published: 2026-09-13 21:31 – Updated: 2026-09-13 21:31
VLAI
Details

Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/h_etc:rw in a compose file.

Severity
6.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-70819"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-24"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-13T19:16:52Z",
    "severity": "MODERATE"
  },
  "details": "Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via \"..\" manipulations such as volumes: - ../../../../../../../etc:/h_etc:rw in a compose file.",
  "id": "GHSA-vmr6-g39x-qp82",
  "modified": "2026-09-13T21:31:41Z",
  "published": "2026-09-13T21:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70819"
    },
    {
      "type": "WEB",
      "url": "https://www.xda-developers.com/nas-wouldnt-give-ssh-access-hacked-into"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VW86-C94W-V3X4

Vulnerability from github – Published: 2026-04-10 19:32 – Updated: 2026-04-24 20:36
VLAI
Summary
SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
Details

Summary

The endpoint /api/av/removeUnusedAttributeView is vulnerable to a path traversal (CWE-22) that allows an attacker to delete arbitrary .json files on the server.

The issue arises because user-controlled input (id) is directly used in filesystem path construction without validation or restriction.

Access to this endpoint (e.g., via a Reader-role or publish context) is considered a precondition and not part of the vulnerability. The root cause is unsafe path handling.

Steps To Reproduce

  1. Ensure the target instance has the publish service enabled (or any valid access to the endpoint).
  2. Send the following request:
POST /api/av/removeUnusedAttributeView HTTP/1.1
Host: <target>
Content-Type: application/json

{
  "id": "../../../conf/conf"
}
  1. Observe that the request is accepted.
  2. The server resolves the path outside the intended directory and deletes the target file.

Impact

An attacker can delete arbitrary .json files within the workspace directory.

This may lead to:

  • Deletion of global configuration files (e.g., conf/conf.json)
  • Loss of user data and application state
  • Corruption of workspace metadata
  • Persistent application instability or forced recovery

This represents a server-side arbitrary file deletion primitive, which can have severe impact depending on the targeted files.

Technical Details

The vulnerable code constructs file paths as follows:

filepath.Join(util.DataDir, "storage", "av", id+".json")

Because id is not validated, attackers can inject path traversal sequences such as ../ to escape the intended directory.

Example payloads

  • ../local → data/storage/local.json
  • ../../storage/outline → data/storage/outline.json
  • ../../../conf/conf → conf/conf.json

No validation or restriction is applied to:

  • input format
  • path normalization
  • directory boundaries

Root Cause

  • Untrusted user input (id) is directly used in filesystem path construction
  • No input validation or sanitization
  • No enforcement that the resolved path stays within the intended directory

Remediation

  1. Validate input strictly

  2. Only allow valid Attribute View IDs

  3. Reject any input containing path traversal sequences

  4. Enforce directory boundaries

base := filepath.Join(util.DataDir, "storage", "av")
absPath := filepath.Join(base, id+".json")

if !util.IsSubPath(base, absPath) {
    return error
}

  1. Normalize paths before use

  2. Ensure canonical paths cannot escape the base directory

  3. Add additional logical checks

  4. Verify that the target object is valid and allowed to be deleted

Severity
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.0.0-20260407035653-2f416e5253f1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.40.0.0-20260407035653-2f416e5253f1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40318"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-24"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T19:32:12Z",
    "nvd_published_at": "2026-04-16T23:16:33Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe endpoint `/api/av/removeUnusedAttributeView` is vulnerable to a **path traversal (CWE-22)** that allows an attacker to delete arbitrary `.json` files on the server.\n\nThe issue arises because user-controlled input (`id`) is directly used in filesystem path construction without validation or restriction.\n\n\u003e Access to this endpoint (e.g., via a Reader-role or publish context) is considered a precondition and not part of the vulnerability. The root cause is unsafe path handling.\n\n---\n\n## Steps To Reproduce\n\n1. Ensure the target instance has the publish service enabled (or any valid access to the endpoint).\n2. Send the following request:\n\n```http\nPOST /api/av/removeUnusedAttributeView HTTP/1.1\nHost: \u003ctarget\u003e\nContent-Type: application/json\n\n{\n  \"id\": \"../../../conf/conf\"\n}\n```\n\n3. Observe that the request is accepted.\n4. The server resolves the path outside the intended directory and deletes the target file.\n\n---\n\n## Impact\n\nAn attacker can delete arbitrary `.json` files within the workspace directory.\n\nThis may lead to:\n\n* Deletion of global configuration files (e.g., `conf/conf.json`)\n* Loss of user data and application state\n* Corruption of workspace metadata\n* Persistent application instability or forced recovery\n\nThis represents a **server-side arbitrary file deletion primitive**, which can have severe impact depending on the targeted files.\n\n---\n\n## Technical Details\n\nThe vulnerable code constructs file paths as follows:\n\n```go\nfilepath.Join(util.DataDir, \"storage\", \"av\", id+\".json\")\n```\n\nBecause `id` is not validated, attackers can inject path traversal sequences such as `../` to escape the intended directory.\n\n### Example payloads\n\n* `../local` \u2192 `data/storage/local.json`\n* `../../storage/outline` \u2192 `data/storage/outline.json`\n* `../../../conf/conf` \u2192 `conf/conf.json`\n\nNo validation or restriction is applied to:\n\n* input format\n* path normalization\n* directory boundaries\n\n---\n\n## Root Cause\n\n* Untrusted user input (`id`) is directly used in filesystem path construction\n* No input validation or sanitization\n* No enforcement that the resolved path stays within the intended directory\n\n---\n\n## Remediation\n\n1. **Validate input strictly**\n\n   * Only allow valid Attribute View IDs\n   * Reject any input containing path traversal sequences\n\n2. **Enforce directory boundaries**\n\n```go\nbase := filepath.Join(util.DataDir, \"storage\", \"av\")\nabsPath := filepath.Join(base, id+\".json\")\n\nif !util.IsSubPath(base, absPath) {\n    return error\n}\n```\n\n3. **Normalize paths before use**\n\n   * Ensure canonical paths cannot escape the base directory\n\n4. **Add additional logical checks**\n\n   * Verify that the target object is valid and allowed to be deleted\n\n---",
  "id": "GHSA-vw86-c94w-v3x4",
  "modified": "2026-04-24T20:36:55Z",
  "published": "2026-04-10T19:32:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40318"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`"
}

GHSA-VX5G-JP83-6M8V

Vulnerability from github – Published: 2024-01-12 21:30 – Updated: 2024-01-12 21:30
VLAI
Details

A vulnerability classified as problematic was found in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file download.php. The manipulation of the argument download_file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-250570 is the identifier assigned to this vulnerability.

Severity
3.5 (Low)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-0465"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-24"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-12T19:15:12Z",
    "severity": "LOW"
  },
  "details": "A vulnerability classified as problematic was found in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file download.php. The manipulation of the argument download_file leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. VDB-250570 is the identifier assigned to this vulnerability.",
  "id": "GHSA-vx5g-jp83-6m8v",
  "modified": "2024-01-12T21:30:19Z",
  "published": "2024-01-12T21:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0465"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BxYQ/vul/blob/main/EMPLOYEE_PROFILE_MANAGEMENT_SYSTEM%20_FileRead.pdf"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.250570"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.250570"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W6PP-PQV8-V26M

Vulnerability from github – Published: 2023-06-14 09:30 – Updated: 2023-06-14 09:30
VLAI
Details

A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.

Severity
3.5 (Low)
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-3240"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-24"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-14T09:15:09Z",
    "severity": "LOW"
  },
  "details": "A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.",
  "id": "GHSA-w6pp-pqv8-v26m",
  "modified": "2023-06-14T09:30:42Z",
  "published": "2023-06-14T09:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3240"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.231511"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.231511"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W9QQ-JMGQ-WFV5

Vulnerability from github – Published: 2025-07-29 00:30 – Updated: 2025-11-03 21:34
VLAI
Details

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-54769"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-24"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-29T00:15:24Z",
    "severity": "HIGH"
  },
  "details": "An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing.  This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.",
  "id": "GHSA-w9qq-jmgq-wfv5",
  "modified": "2025-11-03T21:34:11Z",
  "published": "2025-07-29T00:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54769"
    },
    {
      "type": "WEB",
      "url": "https://korelogic.com/Resources/Advisories/KL-001-2025-016.txt"
    },
    {
      "type": "WEB",
      "url": "https://lpar2rrd.com/note800.php"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Jul/19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WQ5X-HGVH-F6JV

Vulnerability from github – Published: 2023-12-17 15:30 – Updated: 2023-12-17 15:30
VLAI
Details

A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the file /settings/delete_file. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-248258 is the identifier assigned to this vulnerability.

Severity
4.6 (Medium)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-6900"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-24"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-17T14:15:36Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the file /settings/delete_file. The manipulation of the argument file leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. VDB-248258 is the identifier assigned to this vulnerability.",
  "id": "GHSA-wq5x-hgvh-f6jv",
  "modified": "2023-12-17T15:30:19Z",
  "published": "2023-12-17T15:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6900"
    },
    {
      "type": "WEB",
      "url": "https://treasure-blarney-085.notion.site/DashMachine-Arbitrary-File-Deletion-ab44f2fe68e843c393ae9e0c1d487676"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.248258"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.248258"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WXJ3-5CJF-39GH

Vulnerability from github – Published: 2024-04-03 00:30 – Updated: 2024-04-03 00:30
VLAI
Details

A vulnerability classified as critical has been found in Shibang Communications IP Network Intercom Broadcasting System 1.0. This affects an unknown part of the file /php/busyscreenshotpush.php. The manipulation of the argument jsondata[callee]/jsondata[imagename] leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259065 was assigned to this vulnerability.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-3218"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-24"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-03T00:15:08Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability classified as critical has been found in Shibang Communications IP Network Intercom Broadcasting System 1.0. This affects an unknown part of the file /php/busyscreenshotpush.php. The manipulation of the argument jsondata[callee]/jsondata[imagename] leads to path traversal: \u0027../filedir\u0027. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259065 was assigned to this vulnerability.",
  "id": "GHSA-wxj3-5cjf-39gh",
  "modified": "2024-04-03T00:30:56Z",
  "published": "2024-04-03T00:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3218"
    },
    {
      "type": "WEB",
      "url": "https://github.com/garboa/cve_3/blob/main/file_put_content.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.259065"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.259065"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.308510"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X3WR-P869-7P3G

Vulnerability from github – Published: 2025-05-07 18:30 – Updated: 2025-05-07 18:30
VLAI
Details

Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-47423"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-24"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-07T18:15:43Z",
    "severity": "MODERATE"
  },
  "details": "Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server\u0027s private SSL key in cleartext.",
  "id": "GHSA-x3wr-p869-7p3g",
  "modified": "2025-05-07T18:30:50Z",
  "published": "2025-05-07T18:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47423"
    },
    {
      "type": "WEB",
      "url": "https://github.com/haluka92/CVE-2025-47423"
    },
    {
      "type": "WEB",
      "url": "https://pwsdashboard.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X4XJ-9MHP-W8JM

Vulnerability from github – Published: 2026-03-05 09:30 – Updated: 2026-03-06 00:31
VLAI
Details

Path traversal vulnerability in the certificate management module. Impact: Successful exploitation of this vulnerability may affect availability.

Severity
5.9 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-28538"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-24"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-05T08:15:58Z",
    "severity": "MODERATE"
  },
  "details": "Path traversal vulnerability in the certificate management module.\u00a0Impact: Successful exploitation of this vulnerability may affect availability.",
  "id": "GHSA-x4xj-9mhp-w8jm",
  "modified": "2026-03-06T00:31:30Z",
  "published": "2026-03-05T09:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28538"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2026/3"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-5.1
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
  • Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-20
Implementation

Strategy: Input Validation

Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list