Common Weakness Enumeration

CWE-24 Path Traversal: '../filedir'

Description

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-24 ordered by modification date.

17 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-qj4x-9g63-25g6	CVE-2026-34151	HIGH	maven/org.xwiki.platform/xwiki-platform-oldcore	XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+	2026-07-07
GHSA-vgwr-23fq-pr7g	CVE-2026-48047	MODERATE	maven/org.xwiki.platform/xwiki-platform-webjars-api	XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin	2026-05-26
GHSA-gcmj-c9gg-9vh6	CVE-2026-22810	HIGH	npm/@joplin/onenote-converter	@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files	2026-05-19
GHSA-vw86-c94w-v3x4	CVE-2026-40318	HIGH	golang/github.com/siyuan-note/siyuan/kernel	SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`	2026-04-24
GHSA-9fv2-c7v6-p45w	CVE-2024-43035	MODERATE	npm/@fonoster/voice	Fonoster is vulnerable to directory traversal	2026-03-06
GHSA-g2h5-cvvr-7gmw	CVE-2025-59342	MODERATE	golang/github.com/esm-dev/esm.sh	esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header	2026-01-14
GHSA-824x-88xg-cwrv	CVE-2026-21857	HIGH	-	Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read	2026-01-08
GHSA-j893-m93w-jwjw	CVE-2025-67364	HIGH	npm/fast-filesystem-mcp	fast-filesystem-mcp has a Path Traversal vulnerability	2026-01-08
GHSA-78j5-8vq7-jxv5	CVE-2025-56760	MODERATE	golang/github.com/usememos/memos	Memos Vulnerable to Path Traversal via the CreateResource Endpoint	2025-09-05
GHSA-24ch-w38v-xmh8	CVE-2025-53513	HIGH	golang/github.com/juju/juju	Juju zip slip vulnerability via authenticated endpoint	2025-08-26
GHSA-fv2p-qj5p-wqq4	-	HIGH	golang/github.com/lf-edge/ekuiper golang/github.com/lf-edge/ekuiper/v2	LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement	2025-07-03
GHSA-2977-5php-6789	CVE-2024-57189	MODERATE	npm/erxes	Erxes Path Traversal vulnerability	2025-06-10
GHSA-v76w-3ph8-vm66	CVE-2024-1459	MODERATE	maven/io.undertow/undertow-core	Undertow Path Traversal vulnerability	2024-11-22
GHSA-rcvg-rgf7-pppv	CVE-2024-23657	HIGH	npm/@nuxt/devtools	Nuxt Devtools has a Path Traversal: '../filedir'	2024-08-06
GHSA-xq3x-grrj-fj6x	CVE-2023-1800	CRITICAL	golang/github.com/sjqzhang/go-fastdfs	sjqzhang go-fastdfs vulnerable to path traversal	2024-05-20
GHSA-5cgx-vhfp-6cf9	CVE-2020-8568	MODERATE	golang/sigs.k8s.io/secrets-store-csi-driver	Directory traversal in Kubernetes Secrets Store CSI Driver	2023-10-02
GHSA-9qrp-h7fw-42hg	CVE-2022-29253	LOW	maven/org.xwiki.platform/xwiki-platform-oldcore	Path Traversal in XWiki Platform	2022-06-01