Common Weakness Enumeration
CWE-31 Path Traversal: 'dir\..\..\filename'
Description
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir\..\..\filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-31 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-rj98-crf4-g69w | CVE-2024-2044 | CRITICAL |
pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user |
2025-02-13 | |
| GHSA-6w5q-79rf-7c49 | CVE-2024-22723 | MODERATE | - |
Webtrees Path Traversal vulnerability |
2025-01-21 |
| GHSA-5jqc-qj57-4hrc | CVE-2024-36857 | HIGH |
Jan path traversal vulnerability |
2024-06-11 |