CWE-35 Path Traversal: '.../...//'
Description
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-35 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-83rp-q473-j88c | CVE-2026-105683 | LOW |
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service |
2026-10-07 | |
| GHSA-phv5-334h-mxcw | - | CRITICAL |
motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal |
2026-06-23 | |
| GHSA-qwrp-wghp-94q2 | CVE-2026-7302 | CRITICAL |
SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability |
2026-05-29 | |
| GHSA-5v3h-x4wf-5c35 | CVE-2026-25705 | HIGH |
Rancher Extensions have arbitrary file access via path traversal |
2026-05-14 | |
| GHSA-3q34-rx83-r6mq | CVE-2026-42274 | HIGH |
Heimdall has an authorization bypass via path normalization mismatch |
2026-05-12 | |
| GHSA-h3q6-jfrg-3x6q | CVE-2026-25630 | CRITICAL |
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability |
2026-02-05 | |
| GHSA-f8cm-6447-x5h2 | CVE-2025-68428 | CRITICAL |
jsPDF has Local File Inclusion/Path Traversal vulnerability |
2026-01-06 | |
| GHSA-5rxf-fqch-7vqp | CVE-2023-39916 | CRITICAL | - |
NLnet Labs’ Routinator vulnerable to path traversal |
2025-10-03 |
| GHSA-jx4g-3xqm-62vh | CVE-2025-32950 | MODERATE |
io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage |
2025-05-27 | |
| GHSA-qm92-93fv-vh7m | CVE-2024-49770 | HIGH |
Path traversal in oak allows transfer of hidden files within the served root directory |
2024-11-01 | |
| GHSA-g54f-66mw-hv66 | CVE-2024-47171 | LOW |
Agnai vulnerable to Relative Path Traversal in Image Upload |
2024-09-26 | |
| GHSA-h355-hm5h-cm8h | CVE-2024-47170 | LOW |
Agnai File Disclosure Vulnerability: JSON via Path Traversal |
2024-09-26 | |
| GHSA-mpch-89gm-hm83 | CVE-2024-47169 | CRITICAL |
Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal |
2024-09-26 | |
| GHSA-4mrc-w7jh-hx4j | CVE-2024-45190 | MODERATE |
Mage AI Path Traversal vulnerability |
2024-08-23 | |
| GHSA-m5jc-r4gf-c6p8 | CVE-2023-43803 | MODERATE |
Arduino Create Agent path traversal - arbitrary file deletion vulnerability |
2023-11-02 | |
| GHSA-mjq6-pv9c-qppq | CVE-2023-43801 | MODERATE |
Arduino Create Agent path traversal - arbitrary file deletion vulnerability |
2023-11-02 | |
| GHSA-75j7-w798-cwwx | CVE-2023-43802 | HIGH |
Arduino Create Agent path traversal - local privilege escalation vulnerability |
2023-11-02 | |
| GHSA-fm87-46vv-jqrr | CVE-2018-3744 | CRITICAL |
Path Traversal in html-pages |
2023-01-31 | |
| GHSA-rv39-3qh7-9v7w | CVE-2020-5421 | MODERATE |
Improper Input Validation in Spring Framework |
2022-02-08 |