CWE-23: Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
479 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-64446 — A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
- CVE-2024-27199 — In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
- CVE-2025-34510 — Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
- CVE-2024-24578 — RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload
- CVE-2025-52207 — PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbit
- CVE-2026-33494 — Ory Oathkeeper has a path traversal authorization bypass
- CVE-2025-3365 — Relative Path Traversal in OnlineSuite
- CVE-2025-23410 — GMOD Apollo Relative Path Traversal
- CVE-2024-0550 — Privileged User using traversal to read system files
- CVE-2025-47445 — WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability
- CVE-2025-47788 — Missing Path Validation Enables Path Traversal in Controller.php
- CVE-2025-55748 — XWiki Platform's configuration files can be accessed through jsx and sx endpoints
- CVE-2025-55747 — XWiki Platform's configuration files can be accessed through the webjars API
- CVE-2025-55115 — BMC Control-M/Agent path traversal local privilege escalation
- CVE-2026-4415 — GIGABYTE｜Gigabyte Control Center - Arbitrary File Write
- CVE-2025-20059 — PingAM Java Policy Agent path traversal
- CVE-2026-25057 — Zip Slip in MarkUs config upload allowing RCE
- CVE-2024-47051 — Remote Code Execution & File Deletion in Asset Uploads
- CVE-2026-34926 — A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker t
- CVE-2026-25575 — NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality
Recently published
- CVE-2026-79728 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-87747 — Ragic｜Enterprise Cloud Database - Arbitrary File Read
- CVE-2026-47680 — Source controller: Improper path handling allows traversal
- CVE-2026-67367 — A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All
- CVE-2026-80130 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-80133 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-78254 — Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
- CVE-2026-85199 — Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-co
- CVE-2026-81849 — Path traversal in the aws:downloadContent plugin in amazon-ssm-agent
- CVE-2026-81838 — Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)
- CVE-2026-66907 — Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
- CVE-2026-66906 — Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
- CVE-2026-60093 — Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
- CVE-2026-66897 — Instance template path traversal allows arbitrary host file write as root
- CVE-2026-78212 — 4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read
- CVE-2026-53528 — FileWiki has path traversal in RenameAsset via unsanitized oldFilename parameter
- CVE-2026-77113 — Path Traversal Vulnerability in apport-unpack
- CVE-2026-63043 — Apache InLong: Agent path traversal via unvalidated file source path
- CVE-2026-63490 — Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
- CVE-2026-72677 — Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources
More specific weaknesses
- CWE-24 — Path Traversal: '../filedir'
- CWE-25 — Path Traversal: '/../filedir'
- CWE-26 — Path Traversal: '/dir/../filename'
- CWE-27 — Path Traversal: 'dir/../../filename'
- CWE-28 — Path Traversal: '..\filedir'
- CWE-29 — Path Traversal: '\..\filename'
- CWE-30 — Path Traversal: '\dir\..\filename'
- CWE-31 — Path Traversal: 'dir\..\..\filename'
- CWE-32 — Triple Dot
- CWE-33 — Multiple Dot
- CWE-34 — Path Traversal: '....//'
- CWE-35 — Path Traversal: '.../...//'