Common Weakness Enumeration
CWE-26 Path Traversal: '/dir/../filename'
Description
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-26 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-67qg-7284-2277 | CVE-2026-42196 | CRITICAL |
django-s3file is vulnerable to relative path traversal |
2026-05-13 | |
| GHSA-pmgm-h3cc-m4hj | CVE-2024-25466 | HIGH |
React Native Document Picker Directory Traversal vulnerability |
2025-03-27 | |
| GHSA-rgv9-w7jp-m23g | CVE-2025-25295 | HIGH |
Label Studio has a Path Traversal Vulnerability via image Field |
2025-02-14 |