CWE-23 Relative Path Traversal

Backstage: Improper input validation in TechDocs static content requests

Vibe-Trading file-read tools expose arbitrary server-readable files

Apache FreeMarker template loading mechanism vulnerable to path traversal

@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Snipe-IT vulnerable to directory traversal in displaySig

Cloudreve's remote download file paths can escape the selected destination directory

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

hashi-vault-js has a path traversal and query parameter injection

Canonical MicroCeph: path traversal issue in the remote-import AP

Gogs has Path Traversal in organization name that results in RCE through Git hooks

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

Langroid: Path traversal in the file tools allows read/write outside configured current directory

Apache Ignite REST API Has a Relative Path Traversal Vulnerability

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Concrete CMS Vulnerable to Relative Path Traversal