CWE-24
128 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 128
- Last 12 months
- 35
- Critical
- 3
- Known exploited
- 1
Critical 3High 34Medium 78Low 13Not scored 0
CVEs per yearBy the year they were published
- 20201
- 20217
- 20226
- 202319
- 202428
- 202537
- 202630
Known exploitedNewest addition to KEV first
- CVE-2025-27920
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters,…
Srimax · Output Messenger
ExploitedHigh7.2
Newest CVEs
- CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
Apache Software Foundation · Apache OFBiz
Medium6.5 - CVE-2026-118485
Axel Download Accelerator Path Traversal via URL Filename Decoding
Axel Download Accelerator · Axel
High7.0 - CVE-2026-90721
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions…
Dell · PowerProtect Data Domain
Low3.4 - CVE-2026-108980
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized…
Blinko · Blinko
High8.8 - CVE-2026-92533
Path Traversal in BugTracker.NET
BugTracker.NET · BugTracker.NET
High7.1 - CVE-2026-105314
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to…
Papermerge · Papermerge
High7.5 - CVE-2026-104994
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when…
aquasec · Trivy
Low2.5 - CVE-2026-103088
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates…
jknack · handlebars.java
High7.5 - CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data…
Netgate · pfSense Plus
High8.5 - CVE-2026-34151
XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+
xwiki · xwiki-platform
High8.2