CWE-22: Path Traversal vulnerabilities

CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (Appliance) and 5.36.00.00 (Application) contain a path traversal vulnerability (CWE-22). This flaw allows an unauthenticated remote attacker to potentially execute remote code by exploiting improper limitation of pathname to restricted directories. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No official patch or remediation details are provided in the available data. No known exploits in the wild have been reported.

CVE-2026-67281 is a high-severity unauthenticated file-read vulnerability in Mikrotik RouterOS WebFig 7.x branch. It arises from an uninitialized pointer used for file authorization in the /jsproxy path, allowing attackers to escape the WebFig file namespace and access root-owned files, including sensitive configuration stores with credentials. The issue was fixed in RouterOS versions 7.23.4 (Long-term) and 7.24.2 (Stable).

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.

The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

Note Mark, an open-source note-taking application, had an improper input validation vulnerability prior to version 0.19.5. The application validated book and note slug values using an unanchored regular expression, allowing malicious slugs containing directory traversal sequences (e.g., ../../../../../../tmp/escape). During data export, these unsanitized slugs were used to create directories and files outside the intended export path, potentially allowing arbitrary file creation with root privileges. This vulnerability has been fixed in version 0.19.5.

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

IBM Langflow OSS versions 1.0.0 through 1.10.2 contain a path traversal vulnerability (CWE-22) that could allow a remote authenticated attacker to access sensitive information by improperly limiting pathname access to restricted directories. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact focused on confidentiality loss without integrity or availability impact.

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to access sensitive information. This vulnerability does not allow modification or denial of service but can lead to unauthorized data disclosure. The vulnerability has a medium severity with a CVSS score of 6.5.

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when handling requests to the /api/v1/run/{flow_id} endpoint. An attacker with low‑privileged authenticated access (such as a valid API key or user session) can supply crafted path values, including absolute paths or path traversal sequences, allowing arbitrary file writes to locations writable by the Langflow process. Successful exploitation may lead to unauthorized file creation or modification, potentially resulting in further compromise depending on the deployment environment.