CWE-29 Path Traversal: '\..\filename'
Description
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-29 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-3p9q-7w63-3f8q | CVE-2024-7033 | MODERATE |
Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint |
2026-09-02 | |
| GHSA-h39j-r5qq-r9mm | CVE-2026-10732 | MODERATE |
decompress: Arbitrary File Write via Archive Extraction (Zip Slip) |
2026-07-29 | |
| GHSA-vhcx-3pq2-4fvc | CVE-2025-15036 | CRITICAL |
MLFlow path traversal vulnerability |
2026-04-01 | |
| GHSA-9c5q-w6gr-fxcq | CVE-2025-12790 | HIGH |
MQTT does not validate hostnames |
2025-11-06 | |
| GHSA-2rhq-96q8-4vjq | CVE-2025-6209 | HIGH |
LlamaIndex vulnerable to Path Traversal attack through its encode_image function |
2025-07-08 | |
| GHSA-6h3f-43vq-53hj | CVE-2024-2083 | CRITICAL |
Directory traversal in zenml |
2025-05-12 | |
| GHSA-j46q-5pxx-8vmw | CVE-2024-2928 | HIGH |
Local File Inclusion in mlflow |
2025-04-08 | |
| GHSA-rfqq-wq6w-72jm | CVE-2024-3848 | HIGH |
MLflow has a Local File Read/Path Traversal bypass |
2025-04-08 | |
| GHSA-hq88-wg7q-gp4g | CVE-2024-3573 | CRITICAL |
mlflow vulnerable to Path Traversal |
2025-04-08 | |
| GHSA-4rqf-8pfm-p36r | CVE-2024-8859 | HIGH |
MLflow has a Local File Read/Path Traversal in dbfs |
2025-03-21 | |
| GHSA-4qcx-jx49-6qrh | CVE-2024-8769 | CRITICAL |
Aim path traversal in LockManager.release_locks |
2025-03-20 | |
| GHSA-c4cc-w454-4634 | CVE-2024-8537 | CRITICAL |
AgentScope path traversal vulnerability |
2025-03-20 | |
| GHSA-pgfv-gvc5-prfg | CVE-2024-10648 | HIGH |
Gradio Vulnerable to Arbitrary File Deletion |
2025-03-20 | |
| GHSA-8qch-vj6m-2694 | CVE-2024-21542 | HIGH |
luigi Arbitrary File Write via Archive Extraction (Zip Slip) |
2025-02-11 | |
| GHSA-3pww-qvr8-6mhp | CVE-2023-6021 | CRITICAL |
Ray Path Traversal vulnerability |
2025-01-09 | |
| GHSA-hc5w-c9f8-9cc4 | CVE-2024-7774 | MODERATE |
Langchain Path Traversal vulnerability |
2024-11-01 | |
| GHSA-xg73-94fp-g449 | CVE-2023-1177 | CRITICAL |
mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs |
2024-10-01 | |
| GHSA-5r3q-93q3-f978 | CVE-2023-6909 | HIGH |
MLflow Path Traversal Vulnerability |
2024-09-24 | |
| GHSA-wjq3-7jxx-whj9 | CVE-2023-2780 | CRITICAL |
mlflow Path Traversal vulnerability |
2024-09-24 | |
| GHSA-3x47-w4rx-6pm7 | CVE-2024-3429 | HIGH |
LoLLMS Path Traversal vulnerability |
2024-09-13 | |
| GHSA-m7r8-2r98-vppj | CVE-2024-21518 | HIGH | - |
Zip slip in opencart |
2024-07-05 |
| GHSA-w9qf-83jg-2x6c | CVE-2024-6139 | HIGH |
lollms vulnerable to dot-dot-slash path traversal in XTTS server |
2024-06-28 | |
| GHSA-mvrm-fh8q-6wr2 | CVE-2024-5443 | CRITICAL |
Remote Code Execution via path traversal bypass in lollms |
2024-06-24 | |
| GHSA-g9cj-cfpp-4g2x | CVE-2024-1561 | HIGH |
gradio vulnerable to Path Traversal |
2024-05-10 | |
| GHSA-6mv8-95x5-xcq9 | CVE-2023-6038 | CRITICAL |
H2O local file inclusion vulnerability |
2024-04-16 |