Common Weakness Enumeration
CWE-27 Path Traversal: 'dir/../../filename'
Description
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-27 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-4p3w-j4w9-5jqw | CVE-2026-17495 | MODERATE |
moment vulnerable to Path Traversal via crafted non-string locale name |
2026-09-29 | |
| GHSA-f8r6-6222-9pvc | CVE-2025-66518 | HIGH |
Apache Kyuubi Server vulnerable to Path Traversal |
2026-01-05 | |
| GHSA-8hfj-j24r-96c4 | CVE-2022-24785 | HIGH |
Path Traversal: 'dir/../../filename' in moment.locale |
2025-11-04 | |
| GHSA-6f9g-cxwr-q5jr | CVE-2024-23897 | CRITICAL |
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE |
2025-10-22 |