By weakness (CWE)

CWE-23: related vulnerabilities

CVEs classified under CWE-23. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

27 published vulnerabilities

• CVE-2026-25707HIGH 8.8

  libzypp, the package management library used by openSUSE systems, contains a flaw in how it processes repository metadata that could allow an attacker to trick a user into downloading a malicious repository. When this happens, files anywhere on the system can be overwritten, potentially crashing the system or gaining administrative control. The vulnerability requires user interaction—someone must add or update a repository—but once triggered, the impact is severe.

• CVE-2026-50016HIGH 8.8

  pnpm, a widely-used Node.js package manager, contains a path traversal vulnerability affecting versions before 10.34.0 and 11.4.0. A malicious package published to a registry can craft dependency alias metadata containing directory traversal sequences (like '../'). When you run `pnpm install --ignore-scripts`, pnpm treats this alias as a filesystem path without proper validation, allowing the attacker's package to create symlinks that overwrite legitimate files and directories in your project with links pointing to the attacker's package folders. This means an attacker can potentially replace critical project files with their controlled content, even when you explicitly disable script execution during installation.

• CVE-2026-44941HIGH 8.4

  A flaw in how openSUSE's libzypp library processes repository metadata (repomd.xml files) allows attackers who control a malicious repository to execute arbitrary file operations on target systems with root privileges. The vulnerability exists in the handling of the 'keyhint' option and stems from insufficient validation of file paths, enabling an attacker to inject or overwrite sensitive files. Exploitation requires that a user or system add and use the attacker's crafted repository, but once that happens, the impact is severe.

• CVE-2026-5422HIGH 8.1

  A flaw in Jupyter Server version 2.17.0 allows authenticated users to read and write files outside their intended directory boundaries. The vulnerability stems from an incomplete security check that fails to properly validate file path requests, allowing attackers to access sibling directories and potentially sensitive files in shared hosting environments. An attacker with login credentials can exploit this to breach confidentiality and integrity of data across directory structures that were meant to be isolated.

• CVE-2025-53829HIGH 8.0

  ownCloud 10 versions before 10.15.3 contain a path traversal vulnerability that allows administrators with legitimate system access to execute arbitrary code on the server. An attacker would need to first obtain administrative credentials to exploit this, but once they do, they can bypass normal file access restrictions and run malicious commands with full system privileges. This is a significant insider-threat vector for organizations running affected ownCloud versions.

• CVE-2026-14476HIGH 8.0

  A path traversal vulnerability exists in SSSD's Active Directory GPO (Group Policy Object) provider. An attacker with AD GPO management permissions can exploit improper input validation to write files outside the intended GPO cache directory with root privileges. On default Red Hat Enterprise Linux systems running SELinux in enforcing mode, this could be leveraged to modify Kerberos configuration files and bypass authentication mechanisms.

• CVE-2025-41280HIGH 7.8

  Waterfall Security's WF-500 RX Host contains a path traversal vulnerability (Zip Slip) that allows attackers who have already gained access to the TX Host to execute arbitrary code on the RX Host, provided MySQL connector functionality is configured and file compression is enabled. The vulnerability stems from improper handling of file paths during decompression operations, enabling attackers to write files outside their intended directory. This is a privilege escalation concern within an already-compromised environment rather than an initial access vector.

• CVE-2026-59832HIGH 7.7

  SiYuan is an open-source note-taking and knowledge management application. Before version 3.7.1, an authenticated user could exploit improper path handling in the snippets feature to read sensitive files from the application's configuration and database directories. The vulnerability allows an attacker who has valid SiYuan credentials to bypass directory containment checks and access workspace secrets and the document database by crafting specially-formed requests with path traversal sequences.

• CVE-2025-41271HIGH 7.5

  A path traversal vulnerability exists in the Waterfall WF-500 Console WebUI that allows attackers to read sensitive files from affected devices without requiring authentication. The flaw stems from improper handling of relative file paths, enabling an attacker to navigate outside intended directories and access arbitrary files on the system. This is a remote attack requiring only network access—no user interaction or special privileges needed.

• CVE-2026-10073HIGH 7.5

  DreamMaker, a product by Interinfo, contains a flaw that allows attackers to read arbitrary files from the system without authentication. An attacker can exploit a relative path traversal weakness to access sensitive system files they shouldn't be able to reach. This is a network-accessible vulnerability, meaning an attacker doesn't need physical access or prior system credentials to attempt exploitation.

• CVE-2026-54066HIGH 7.5

  SiYuan, an open-source personal knowledge management system, contains a path traversal vulnerability in its publish mode that allows unauthenticated attackers to read sensitive files from the server. The vulnerability exists because a previous patch for a similar issue only fixed one route (/export/) but left the same weakness in another route (/assets/). By using double-URL-encoding to bypass sanitization, an attacker can download configuration files containing credentials, database files, and logs—all without needing to log in. This affects versions prior to 3.7.0.

• CVE-2026-8023HIGH 7.5

  Zephyr's HTTP server has a path-traversal vulnerability in its static file serving feature. When configured to serve files from a specific directory, the server fails to properly validate request paths, allowing an attacker to use sequences like ../../ to escape the intended directory and read arbitrary files on the system. An unauthenticated remote attacker can exploit this over the network without encryption or authentication—they simply craft a specially-formed HTTP request to retrieve sensitive files they shouldn't have access to.

• CVE-2026-41046HIGH 7.3

  qSnapper before version 1.3.3 contains a path traversal vulnerability in how it handles the 'configName' parameter. A local attacker can exploit this to supply malicious configuration files to the snapper tool, leading to denial of service or potential privilege escalation to root. This is a local-only attack that requires no authentication and no user interaction.

• CVE-2026-61343HIGH 7.2

  LibreBooking contains a path traversal vulnerability in its email template editor. When an authenticated administrator saves an email template, the application fails to validate the template name before using it to construct the file path. An attacker with admin credentials can craft a malicious template name containing path traversal sequences (like `../`) to write files outside the intended template directory. By placing a file in a web-accessible location or a directory where code is executed, the attacker can achieve remote code execution on the server.

• CVE-2026-48569HIGH 7.1

  A flaw in Visual Studio Code's input handling allows a local attacker to circumvent a security mechanism without requiring elevated privileges or special user setup. The attacker must interact with the application through the user interface, but once triggered, the exploit can affect system-wide settings and processes beyond the application's normal scope. This is a local-attack surface issue that could allow an unauthorized actor to modify or access protected features.

• CVE-2026-50181HIGH 7.1

  Langroid is a framework that helps developers build applications powered by large language models (LLMs). Versions before 0.64.0 contain a path traversal vulnerability in the file reading and writing tools. While these tools are meant to restrict file operations to a specified directory, they fail to properly validate file paths. An attacker with access to trigger tool calls can use path traversal sequences like `../` to read sensitive files outside the intended directory or write malicious files in unexpected locations. This is particularly concerning when Langroid applications expose these tools directly to LLM agents or accept user-controlled instructions, as the safety boundary meant to isolate file access can be completely bypassed.

• CVE-2026-57988HIGH 7.1

  Microsoft Edge (Chromium-based) contains a relative path traversal vulnerability that could allow an attacker to execute arbitrary code on a user's system over the network. The vulnerability requires user interaction—such as clicking a malicious link or visiting a compromised website—but once triggered, an attacker can bypass security controls and run code with the privileges of the Edge process.

• CVE-2026-58522MEDIUM 6.8

  Microsoft Edge for Android contains a flaw that allows an attacker with local access to a device to view sensitive files through relative path traversal. This occurs because the application improperly validates file paths, enabling an attacker to navigate beyond intended directories and access information they should not be able to reach. An attacker does not need special permissions or user interaction to exploit this vulnerability.

• CVE-2025-48977MEDIUM 6.5

  Apache Ignite REST API contains a path traversal vulnerability that allows authenticated users to read arbitrary files from the server by manipulating the log path parameter in API commands. An attacker with valid REST API credentials can escape the intended log directory and access sensitive files anywhere on the system. This affects Ignite versions 2.0.0 through 2.17.0, and the vendor has released version 2.18.0 to address it.

• CVE-2026-47287MEDIUM 6.5

  Visual Studio Code contains a path traversal vulnerability that could allow an attacker to modify files on your system through a malicious link or network request. The vulnerability requires user interaction—such as clicking a link or opening a file—but does not require authentication. An attacker cannot read sensitive data through this vulnerability, but they can alter or corrupt files if they successfully exploit it.

• CVE-2026-59149MEDIUM 6.5

  Mockoon is a tool used by developers to create and test mock APIs locally. A flaw in versions before 9.7.0 allows an attacker to read files from outside the intended mock API directory by crafting specially-formatted file requests. Because the validation check for file paths doesn't properly enforce directory boundaries, an attacker can use path-traversal tricks to escape the sandbox and access other files on the server. This vulnerability requires user interaction (the victim must visit a malicious link or request) but no authentication, and it exposes sensitive data rather than modifying or deleting it.

• CVE-2026-48681MEDIUM 5.9

  OpenStack Ironic, a bare-metal provisioning service, contains a directory traversal vulnerability that allows authenticated administrators to overwrite arbitrary files on the system during deployment when using a specially crafted ISO image. An attacker with high-level privileges can exploit this during the boot image creation process to alter critical system files or configuration, potentially compromising the integrity of deployed infrastructure.

• CVE-2026-10074MEDIUM 4.9

  DreamMaker, a product developed by Interinfo, contains a vulnerability that allows authenticated administrators or privileged users with local access to read arbitrary files from the system. An attacker with elevated privileges can exploit a path traversal flaw to access sensitive system files they shouldn't normally be able to retrieve, potentially exposing configuration data, credentials, or other protected information.

• CVE-2026-8650MEDIUM 4.5

  Progress MOVEit Transfer contains a relative path traversal vulnerability in its Admin Settings module that allows an authenticated administrator to read sensitive files on the server. The flaw exists in versions before 2025.0.7 and 2025.1.x versions before 2025.1.3. While it requires high-privilege access and provides read-only exposure, the ability to traverse the file system and access confidential data presents a meaningful risk to organizations relying on MOVEit for secure file transfer operations.

• CVE-2026-59995MEDIUM 4.2

  OpenSSH's SFTP client has a path traversal vulnerability affecting versions before 10.4. When a user downloads files from a server using the command "sftp server:/path ." (downloading to the current directory), an attacker controlling the SFTP server can craft malicious responses that cause files to be written outside the intended download location. This requires user interaction—specifically, the user must initiate the download command—and relies on the attacker operating a malicious SFTP server. The vulnerability allows file overwrite or creation in unintended directories, potentially compromising system integrity if critical files are targeted.

• CVE-2026-59996MEDIUM 4.2

  OpenSSH's scp command has a path traversal vulnerability that can cause files to be written to an unintended location when copying between two remote systems. If an attacker controls the source or destination in a remote-to-remote copy operation, they may be able to place a file in the parent directory of where it was supposed to go, potentially overwriting legitimate files or introducing malicious content into unexpected locations. This affects OpenSSH versions before 10.4.

• CVE-2026-8387LOW 2.4

  ClearML, an open-source ML operations platform, contains a flaw in how it extracts compressed files from remote sources. When users download datasets, models, or artifacts, the system unpacks `.zip` files without properly validating file paths. An attacker can craft a malicious archive containing specially-named files that, when extracted, write to sensitive locations on the server—such as configuration directories or cron job folders. While the CVSS score is low due to requiring high-level authentication and user interaction, the potential for abuse exists in multi-tenant or shared environments where dataset or model files pass through untrusted sources.