CWE-22: Path Traversal vulnerabilities

CVE-2026-84069 is a medium severity vulnerability in the WebFacing™ WordPress plugin versions 5.3 up to but not including 5.4. It involves improper limitation of a pathname to a restricted directory (CWE-22), allowing unauthenticated users to perform Local File Inclusion by exploiting a bundled script that does not validate user-supplied paths.

CVE-2026-97163 is a critical vulnerability in the lomart.fr UP plugin for Joomla affecting versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. It involves improper limitation of a pathname to a restricted directory (CWE-22), allowing unauthenticated remote code installation. The vulnerability has a CVSS 4.0 base score of 10.0, indicating it is exploitable over the network without authentication and can lead to severe impact. No patch or remediation information is currently available from the vendor.

A critical path traversal vulnerability (CWE-22) exists in the lomart.fr UP plugin for Joomla, affecting versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. This vulnerability allows unauthorized access to restricted directories and files by improperly limiting pathname inputs. It has a high CVSS 4.0 score of 9.2, indicating it is network exploitable without requiring privileges or user interaction, with a high impact on confidentiality and security controls. No official patch or remediation guidance is currently available.

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.

IBM Guardium Data Protection version 12.2 contains a path traversal vulnerability in the Universal Connector Oracle Wallet upload component. This flaw allows an authenticated remote attacker to write arbitrary files to the system, potentially compromising confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.5.

CVE-2026-93643 is a critical path traversal vulnerability in Zimbra Collaboration Suite (ZCS) affecting versions prior to 10.1.21. It allows an unauthenticated remote attacker with access to a supported public Briefcase document to abuse unsigned save fields, enabling path-traversal writes and command execution as the zimbra user. The vulnerability arises when OnlyOffice/Document Editing is enabled. The CVSS 3.1 score is 9.8, indicating high impact on confidentiality, integrity, and availability.

IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory.

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. This flaw allows an attacker on the device's WiFi network to craft requests that access files on removable storage not intended for web access, such as recordings, images, logs, or firmware files. The vulnerability affects specific firmware versions and has a high severity rating.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal.

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path confinement check uses `str.startswith()` rather than proper boundary validation, allowing an authenticated admin to read `.log`, `.jsonl`, and `.json` files outside the configured `LOG_FOLDER` by supplying a filename that resolves into a sibling directory whose absolute path shares the log directory's string prefix.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124.

Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVE-2026-82077 is a path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF. It allows an authenticated administrator to execute arbitrary commands on the underlying host by using crafted fax provider settings. The vulnerability affects multiple version ranges of PaperCut NG/MF. The CVSS 4.0 score is 7.3, indicating a high severity issue.

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.