CWE-22: Path Traversal vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file write on the victim's host.

Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

Szafir, a product by Krajowa Izba Rozliczeniowa, has a path traversal vulnerability in the handling of uploaded filenames. An attacker capable of intercepting and redirecting update requests can craft an arbitrary XML file that the system saves to a location chosen by the attacker. This vulnerability is identified as CWE-22 and was fixed in version 2.0 build 708. The CVSS 4.0 score is low (2.3), reflecting limited impact and attack complexity.

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.

A critical path traversal vulnerability exists in the Automated Import Products to Cart WordPress plugin before version 1.0.4. This flaw allows users with minimal permissions, such as subscribers, to read and delete arbitrary files on the server by exploiting improper sanitization of user-supplied file paths. The vulnerability can lead to exposure of sensitive data, including database credentials, and unauthorized file deletion.

CVE-2026-75520 is a path traversal vulnerability in Domoticz prior to version 2026.3. It allows a low-privilege authenticated user to execute existing operator-installed Lua parser scripts via the udevices JSON command handler without proper session rights checks. The vulnerability arises because the script parameter lacks path traversal protections, enabling access to Lua scripts through the GET /json.htm endpoint. Execution is limited to already-installed Lua files, and arbitrary code execution is not possible. The issue is fixed in Domoticz version 2026.3.

CVE-2026-93851 is a path traversal vulnerability in Mattermost versions 11.7.x through 11.9.1 affecting the Agents plugin's mention reminder component. An authenticated user with posting permissions in a channel visible to a system administrator can craft a post with a forged mention reminder. If the administrator clicks this mention, it triggers an unintended API request that replaces an installed plugin, enabling code execution on the server.

A path traversal vulnerability (CWE-22) exists in langchain-ai's langgraph Python SDK and langgraph versions prior to 0.4.6 and 1.2.14 respectively. The issue arises when RemoteGraph v3 streaming uses affected versions of langgraph-sdk, where caller-controlled assistant_id and thread_id values are interpolated into authenticated GET request paths without proper encoding. This allows relative path segments to be normalized into other readable paths on the server while retaining authentication headers. The vulnerability is fixed in langgraph-sdk 0.4.6 and langgraph 1.2.14.

CVE-2026-118654 is a path traversal vulnerability in the labstack Echo Go web framework. Versions prior to 4.16.0 and between 5.0.0 and before 5.4.0 allow unauthenticated attackers to bypass route-level middleware protections by exploiting static file handlers that normalize dot segments after route matching. This enables unauthorized reading of files intended to be protected. The issue is a regression from an incomplete fix of a previous vulnerability and is resolved in versions 4.16.0 and 5.4.0.

FearlessCMS versions prior to 0.1.4 contain multiple unauthenticated debug/test PHP scripts under the admin directory that allow privileged operations without authentication or CSRF protection. These scripts enable attackers to bypass admin login via crafted URIs, perform arbitrary file writes and reads including path traversal, execute stored cross-site scripting, enumerate directories, and cause disk exhaustion. The vulnerability allows site defacement, session theft, and potential full system compromise when PHP runs with elevated privileges. The issue is fixed in version 0.1.4.

CVE-2026-118619 is a path traversal vulnerability in Ultralytics version 8.4.103 related to handling downloads from Google Drive. It allows remote attackers to execute arbitrary code by supplying a crafted path that is not properly validated before file operations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity with a CVSS score of 8.8.

CVE-2026-103407 is a path traversal vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's ConfigDirector component. It allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.

CVE-2026-105420 is a critical path traversal vulnerability in Wing Soft Technology's Wing FTP Server that allows an attacker with administrative privileges to escape the intended base folder and write arbitrary files on the system. This can lead to remote code execution with the privileges of the process owner. The vulnerability is fixed in version 8.2.6.

OpenHop versions prior to 0.3.7 contain a path traversal vulnerability in the server component that allows unauthenticated attackers to read or delete YAML files outside the intended directory. This occurs because flow route parameters are passed without an identifier allow-list and are decoded and normalized in a way that permits directory traversal. The vulnerability is exacerbated by permissive CORS settings and default Docker configurations that allow unauthenticated network access. The issue is fixed in version 0.3.7.

CVE-2026-118038 is a path traversal vulnerability in Progress Software's Telerik Document Processing Libraries versions from 2026.1.210 up to but not including 2026.3.1027. It allows an authenticated low-privilege attacker who can supply tool arguments to read and overwrite files outside the intended output directory by using relative file paths. The issue affects the Convert and Merge AI agent tools. This vulnerability is fixed in version 2026.3.1027.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS2025 and LTS2026 releases, contain a path traversal vulnerability (CWE-22). This flaw allows a high privileged remote attacker to potentially disclose sensitive information by bypassing directory restrictions. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, and 8.3.1.50 respectively.