CWE-36

151 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 5 of them as exploited in the wild.

Critical 17High 71Medium 59Low 4Not scored 0

CVEs per yearBy the year they were published

CVE-2024-48248
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code…
NAKIVO · Backup & Replication Director
ExploitedHigh8.6
CVE-2024-13159
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
Ivanti · Endpoint Manager
ExploitedCritical9.8
CVE-2024-13160
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
Ivanti · Endpoint Manager
ExploitedCritical9.8
CVE-2024-13161
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
Ivanti · Endpoint Manager
ExploitedCritical9.8
CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When…
Check Point Software Technologies Ltd. · WinRAR
ExploitedHigh7.8

CVE-2026-123619
Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths
lektor · lektor
Medium5.9
CVE-2026-116635
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
AWS · aws-serverless-mcp-server
Medium6.9
CVE-2026-118693
CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path
giuspen · cherrytree
Medium5.6
CVE-2026-83746
Skype for Business Elevation of Privilege Vulnerability
Microsoft · Skype for Business Server 2015 CU13
High8.1
CVE-2026-70297
Skype for Business Remote Code Execution Vulnerability
Microsoft · Skype for Business Server 2015 CU13
High8.8
CVE-2026-83683
Windows Encrypting File System (EFS) Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
Medium6.5
CVE-2026-83784
Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
High8.8
CVE-2026-55062
uniget: Path Traversal in Hook Files - Directory Escape Vulnerability
uniget-org · cli
High8.4
CVE-2025-70820
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.
Zettlab · D6 Ultra
Low3.5
CVE-2026-89009
WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server
WAVLINK Technology · WN535M1
High8.8