CVE Database

CVE-2026-50454 High · 7.8 CWE-23 Jul 14, 2026

Windows User Interface Core Elevation of Privilege Vulnerability

Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

CVE-2026-50426 Medium · 6.8 CWE-23 Jul 14, 2026

Windows DNS Server Remote Code Execution Vulnerability

Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.

CVE-2026-50663 High · 8.8 CWE-23 Jul 14, 2026

Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network.

CVE-2026-40400 High · 8.0 CWE-23 Jul 14, 2026

Windows PowerShell Remote Code Execution Vulnerability

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

CVE-2026-14903 Medium · 6.5 CWE-23 Jul 14, 2026

Relative Path Traversal in Ivanti Xtraction

Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

CVE-2026-55474 Medium · 6.5 CWE-23 Jul 10, 2026

Snipe-IT: Directory traversal in displaySig

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.

CVE-2026-59792 Critical · 9.8 CWE-23 Jul 10, 2026

Relative Path Traversal in Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

CVE-2026-61343 High · 7.2 CWE-23 Jul 9, 2026

LibreBooking path traversal

LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0.

CVE-2026-8650 High · 7.5 CWE-23 Jul 8, 2026

Authenticated Path Traversal allows MOVEit admins to view arbitrary system files

Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

CVE-2026-59996 Medium · 5.4 CWE-23 Jul 7, 2026

Relative Path Traversal in Openbsd Openssh

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

CVE-2026-59995 Medium · 5.4 CWE-23 Jul 7, 2026

Relative Path Traversal in Openbsd Openssh

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

CVE-2026-14476 High · 8.0 CWE-23 Jul 7, 2026

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

CVE-2026-57871 High · 7.1 CWE-23 Jul 7, 2026

Relative Path Traversal in MicroRealEstate

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.

CVE-2025-53829 High · 8.0 CWE-23 Jul 6, 2026

ownCloud 10 is vulnerable to Relative Path Traversal

ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can exploit a path traversal vulnerability in the system to execute arbitrary code. Upgrade ownCloud 10 to version 10.15.3 or later to receive a patch.

CVE-2026-58522 Medium · 5.5 CWE-23 Jul 3, 2026

Microsoft Edge for Android Information Disclosure Vulnerability

Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

CVE-2026-57988 High · 7.1 CWE-23 Jul 3, 2026

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-44941 High · 8.8 CWE-23 Jul 2, 2026

libzypp path traversal via "keyhint" in repomd.xml

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

CVE-2026-8387 Low · 2.4 CWE-23 Jul 1, 2026

Relative Path Traversal in allegroai/clearml

A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile.extractall()` method in `StorageManager._extract_to_cache()`. This issue arises due to the lack of path traversal validation, enabling an attacker to write arbitrary files to the filesystem. Attack vectors include dataset downloads, artifact downloads, model downloads, and offline session imports. The vulnerability can lead to remote code execution through methods such as cron job injection, SSH key overwrite, or web shell deployment. The issue is resolved in version 2.1.6.

CVE-2026-44948 Medium · 4.9 CWE-23 Jun 30, 2026

Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler

A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.

CVE-2026-25707 High · 8.8 CWE-23 Jun 29, 2026

Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

CVE-2026-50016 High · 8.8 CWE-23 Jun 25, 2026

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install --ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.

CVE-2026-45188 Low · 2.4 CWE-23 Jun 25, 2026

Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling

Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVE-2026-52813 Critical · 10.0 CWE-23 Jun 24, 2026

Gogs Path Traversal in Organization Names Leading to Remote Code Execution

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.

CVE-2026-41046 High · 7.3 CWE-23 Jun 22, 2026

path traversal via `config` parameter in qSnapper

A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious config files for snapper and so cause a denial of service or potentially escalate privileges to root.

CVE-2026-10720 Medium · 5.1 CWE-23 Jun 19, 2026

MicroCeph path traversal issue in the remote-import API

Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.