An

issue

was

discovered

in

XiaoCms

allows

arbitrary

directory

deletion

via

admin/index.php?c=database&a=import&paths=../

directory

traversal.


Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the underlying system with privileges of the user running the application. Especially an attacker may leverage the vulnerability to write an executable JSP file in an exposed web directory to execute commands on the underlying system.


An issue was discovered in zzcms 8.2. user/licence_save.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.


An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.


Apache Ambari versions 1.4.0 to 2.6.1 is susceptible to a directory traversal attack allowing an unauthenticated user to craft an HTTP request which provides read-only access to any file on the filesystem of the host the Ambari Server runs on that is accessible by the user the Ambari Server is running as. Direct network access to the Ambari Server is required to issue this request and those Ambari Servers that are protected behind a firewall or in a restricted network zone are at less risk of being affected by this issue.


An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.


A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server related to ../ in the att_local_name field in Deliver.class.php.


In Ruby before 2.2.10 2.3.x before 2.3.7 2.4.x before 2.4.4 2.5.x before 2.5.1 and 2.6.0-preview1 the Dir.open Dir.new Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method unintentional directory traversal may be performed.


PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.


In webERP 4.15 Z_CreateCompanyTemplateFile.php has Incorrect Access Control leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.


PHP Scripts Mall Charity Foundation Script 1 through 3 allows directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.


PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uploads/ directory.


PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.


An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF.


In pkg/tool/path.go in Gogs before 0.11.82.1218 a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server a similar issue to CVE-2018-18925.


imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter.


Lei

Feng

TV

CMS

(aka

LFCMS)

allows

Directory

Traversal

via

crafted

use

of

in

Template/edit/path

URIs

as

demonstrated

by

the

admin.php?s=/Template/edit/path/*web*..*..*..*..*1.txt.html

URI

to

read

the

file.


PHP Scripts Mall Advance B2B Script 2.1.4 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.


PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.


PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.


Roxy

Fileman

allows

Directory

Traversal

in

copydir.php

copyfile.php

and

fileslist.php.


An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.


RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.


PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.


exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter.


An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock.


Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.


Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.


WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application directory via a specially crafted XML request aka Directory Traversal.


In CMS Made Simple 2.2.7 a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request.


In

Gxlcms

QY

allows

remote

attackers

to

delete

any

file

via

directory

traversal

sequences

in

the

id

parameter

of

an

Admin-Data-del

request.


In Spark before 2.7.2 a remote attacker can read unintended static files via various representations of absolute or relative pathnames as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.


The function down_sql_action() in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=down_sql&name=../ URI.


An

issue

was

discovered

in

litemall

Arbitrary

file

download

is

possible

via

directory

traversal

in

in

the

litemall-wx-api

component.


An

issue

was

discovered

in

BageCMS

An

attacker

can

delete

any

files

and

folders

on

the

web

server

via

an

index.php?r=admini/template/batch&command=deleteFile&fileName=

or

index.php?r=admini/template/batch&command=deleteFolder&folderName=../

directory

traversal

URI.


Certain older Lexmark devices (C M X and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server.


PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read sensitive files on the system via directory traversal bypassing the login page as demonstrated by the Mailserver_filesystem/home.php coninb consent contrsh condrft or conspam parameter.


An

issue

was

discovered

in

PopojiCMS

allows

remote

attackers

to

delete

arbitrary

files

via

directory

traversal

in

the

po-admin/route.php?mod=library&act=delete

id

parameter.


Directory traversal vulnerability in Microstrategy Web version 7 in \/WebMstr7/servlet/mstrWeb\ (in the parameter subpage) allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application. NOTE: this is a deprecated product.


** DISPUTED ** chmextract.c in the chmextract sample program as distributed with libmspack before 0.8alpha does not protect against absolute/relative pathnames in CHM files leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability because chmextract.c was only intended as a source-code example not a supported application.


An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock.


The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.


Remote

Directory

Traversal

and

Remote

Disclosure

of

Privileged

Information

in

UCMDB

Configuration

Management

Service

version

The

vulnerabilities

could

allow

Remote

Directory

Traversal

and

Remote

Disclosure

of

Privileged

Information


An

issue

was

discovered

in

in

MCMS

An

attacker

can

write

a

.jsp

file

(in

the

position

parameter)

to

an

arbitrary

directory

via

a

Directory

Traversal

in

the

url

parameter.


QuaZIP before 0.7.6 is vulnerable to directory traversal allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


zt-zip before 1.13 is vulnerable to directory traversal allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


adm-zip npm library before 0.4.9 is vulnerable to directory traversal allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


plexus-archiver before 3.6.0 is vulnerable to directory traversal allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


SharpZipLib before 1.0 RC1 is vulnerable to directory traversal allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


SharpCompress before 0.21.0 is vulnerable to directory traversal allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


zip4j before 1.3.3 is vulnerable to directory traversal allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


mholt/archiver

golang

package

before

is

vulnerable

to

directory

traversal

allowing

attackers

to

write

to

arbitrary

files

via

a

(dot

dot

slash)

in

an

archive

entry

that

is

mishandled

during

extraction.

This

vulnerability

is

also

known

as

'Zip-Slip'.


unzipper npm library before 0.8.13 is vulnerable to directory traversal allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.


Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using directory traversal.


OX App Suite 7.8.4 and earlier allows Directory Traversal.


Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the \file1\ URL parameter a similar issue to CVE-2018-11344.


An issue was discovered in PublicCMS V4.0.20180210. There is a \Directory Traversal\ and \Arbitrary file read\ vulnerability via an admin/cmsWebFile/list.html?path=../ URI.


Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.


An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.


(formerly

Redatam

WebServer)

allows

remote

attackers

to

read

arbitrary

files

via

/redbin/rpwebutilities.exe/text?LFN=../

directory

traversal.


An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g. outside of the /home directory tree) by passing directory traversal sequences such as a home/../usr substring.


Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL path.


OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.


Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the \path\ URL parameter. NOTE: the \filename\ POST parameter is covered by CVE-2018-11345.


Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the \file\ and \folder\ URL parameters.


An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF.


An

issue

was

discovered

in

PublicCMS

There

is

a

\Directory

Traversal\

and

\Arbitrary

file

read\

vulnerability

via

an

admin/cmsTemplate/content.html?path=../

URI.


The

websites

that

were

built

from

Zeta

Producer

Desktop

CMS

before

are

vulnerable

to

unauthenticated

file

disclosure

if

the

plugin

\filebrowser\

is

installed

because

of

assets/php/filebrowser/filebrowser.main.php?file=../

directory

traversal.


A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.


Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the \path\ URL parameter.


Directory traversal in Jester web framework 0.2.0 allows remote attackers to fetch files in arbitrary locations via \..%f\ sequences.


Directory traversal in list_folders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the \path\ parameter.


A vulnerability has been identified in SIMATIC HMI Comfort Panels 4\ - 22\ (All versions < V15 Update 4) SIMATIC HMI Comfort Outdoor Panels 7\ & 15\ (All versions < V15 Update 4) SIMATIC HMI KTP Mobile Panels KTP400F KTP700 KTP700F KTP900 and KTP900F (All versions < V15 Update 4) SIMATIC WinCC Runtime Advanced (All versions < V15 Update 4) SIMATIC WinCC Runtime Professional (All versions < V15 Update 4) SIMATIC WinCC (TIA Portal) (All versions < V15 Update 4) SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). A directory traversal vulnerability could allow to download arbitrary files from the device. The security vulnerability could be exploited by an attacker with network access to the integrated web server. No user interaction and no authentication is required to exploit the vulnerability. The vulnerability impacts the confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability in Cisco Data Center Network Manager software could allow an authenticated remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management interface. An attacker could exploit this vulnerability by sending malicious requests containing directory traversal character sequences within the management interface. An exploit could allow the attacker to view or create arbitrary files on the targeted system.


A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall Cisco RV130W Wireless-N Multifunction VPN Router and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to the targeted device. A successful exploit could allow the attacker to gain access to arbitrary files on the affected device resulting in the disclosure of sensitive information.


A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location.


Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system.


A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated remote attacker to view sensitive information. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames and pathnames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files on the targeted device which may contain sensitive information.


An issue was discovered in BearAdmin 0.5. Remote attackers can download arbitrary files via /admin/databack/download.html?name= directory traversal sequences as demonstrated by name=../application/database.php to read the MySQL credentials in the configuration.


Xovis

and

devices

through

allow

Directory

Traversal.


util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places \../\ in the file name the file can be stored in an unintended directory because of Directory Traversal.


OpenCart

through

allows

directory

traversal

in

the

editDownload

function

in

via

admin/index.php?route=catalog/download/edit

related

to

the

For

example

an

attacker

can

download


A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4) Automation License Manager 6 (All versions < 6.0.1). A directory traversal vulnerability could allow a remote attacker to move arbitrary files which can result in code execution compromising confidentiality integrity and availability of the system. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges or special conditions of the system but user interaction is required.


The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script.


Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter.


The 'IMAGES_JSON' and 'attachments_to_remove' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.


The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary locations on the server due to missing basedir restrictions (absolute directory traversal).


Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06 DIR-140L through 1.02 DIR-640L through 1.02 DWR-512 through 2.02 DWR-712 through 2.02 DWR-912 through 2.02 DWR-921 through 2.02 and DWR-111 through 1.01 devices allows remote attackers to read arbitrary files via a /.. or // after \GET /uir\ in an HTTP request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.


CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request because code under modules\\FilePicker does not restrict the val parameter.


Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform.


IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.


perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.


QingDao Nature Easy Soft Chanzhi Enterprise Portal System (aka chanzhieps) pro1.6 allows remote attackers to read arbitrary files via directory traversal sequences in the pathname parameter to www/file.php.


A directory traversal issue was found in reposync a part of yum-utils where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.


An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings.


An issue was discovered on D-Link DWR-116 through 1.06 DIR-140L through 1.02 DIR-640L through 1.02 DWR-512 through 2.02 DWR-712 through 2.02 DWR-912 through 2.02 DWR-921 through 2.02 and DWR-111 through 1.01 devices. The administrative password is stored in plaintext in the /tmp/csman/0 file. An attacker having a directory traversal (or LFI) can easily get full router access.


Digital Guardian Management Console 7.1.2.0015 has a Directory Traversal issue.


The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal resulting in the potential writing of files under unwanted locations the overwriting of existing files or their deletion. This issue was addressed in Apache ODE 1.3.3 which was released in 2009 however the incorrect name CVE-2008-2370 was used on the advisory by mistake.


Spring Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions allow applications to configure Spring MVC to serve static resources (e.g. CSS JS images). When static resources are served from a file system on Windows (as opposed to the classpath or the ServletContext) a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.


okular version 18.08 and earlier contains a Directory Traversal vulnerability in function \unpackDocumentArchive(...)\ in \core/document.cpp\ that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1


WeBid

version

up

to

current

version

contains

a

Directory

Traversal

vulnerability

in

getthumb.php

that

can

result

in

Arbitrary

Image

File

Read.

This

attack

appear

to

be

exploitable

via

HTTP

GET

Request.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


RubyGems version Ruby 2.2 series: 2.2.9 and earlier Ruby 2.3 series: 2.3.6 and earlier Ruby 2.4 series: 2.4.3 and earlier Ruby 2.5 series: 2.5.0 and earlier prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.


log-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bin/log-user-session that can result in User to root privilege escalation. This attack appear to be exploitable via Malicious unprivileged user executes the vulnerable binary/(remote) environment variable manipulation similar shell-shock also possible.


nmap version 6.49BETA6 through 7.60 up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7.


RubyGems version Ruby 2.2 series: 2.2.9 and earlier Ruby 2.3 series: 2.3.6 and earlier Ruby 2.4 series: 2.4.3 and earlier Ruby 2.5 series: 2.5.0 and earlier prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.


The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem. This attack appear to be exploitable via HTTP GET/POST request. This vulnerability appears to have been fixed in 6.2.32.


Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources otherwise unavailable to her.. This attack appear to be exploitable via An attacker should have access to an encoded path parameter on POST PUT or DELETE request.. This vulnerability appears to have been fixed in 2.5.0 and later.


MODX

Revolution

version

contains

a

Directory

Traversal

vulnerability

in

that

can

result

in

remove

files.

This

attack

appear

to

be

exploitable

via

web

request

via

security/login

processor.

This

vulnerability

appears

to

have

been

fixed

in

pull


Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially crafted GET request containing directory traversal from assets-pipeline context. This vulnerability appears to have been fixed in 2.14.1.1 (for Grails 2.x) 2.15.1 (for Grails 3 and Java 7) and 3.0.6 (for Grails 3 and Java 8).


rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files an attacker can upload a malicious file that contains symlinks or files with absolute pathnames \../\ to write arbitrary files to the filesystem..


Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks as demonstrated by \POST /PY/EMULATION_GET_FILE\ or \POST /PY/EMULATION_EXPORT\ with FileName=../../../passwd in the POST data.


An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles \..\ directory traversal in a mailbox name.


LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.


CMS

ISWEB

is

vulnerable

to

directory

traversal

and

local

file

download

as

demonstrated

by

moduli/downloadFile.php?file=oggetto_documenti/../.././inc/config.php

(one

can

take

the

control

of

the

application

because

credentials

are

present

in

that

config.php

file).


The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.


cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.


MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.


Citrix XenServer 7.1 and newer allows Directory Traversal.


Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.


A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences aka CSL-1683.


The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal as demonstrated by /../../etc/passwd on TCP port 80.


In

the

\Media

from

FTP\

plugin

before

for

WordPress

Directory

Traversal

exists

via

the

searchdir

parameter

to

the

wp-admin/admin.php?page=mediafromftp-search-register

URI.


The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php.


An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing scripts.


Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the \docid\ parameter when the mode is set to delete.


/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action aka Directory Traversal.


Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files aka /media/api Directory Traversal.


WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API.


Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to read arbitrary files via the \docid\ parameter when the mode is set to get.


Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.


Visiology Flipbox Software Suite before 2.7.0 allows directory traversal via %5c%2e%2e%2f because it does not sanitize filename parameters.


In Docker through 18.06.1-ce-rc2 the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal giving attackers arbitrary read-write access to the host filesystem with root privileges because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).


/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call as demonstrated by a file:///etc/passwd value.


Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs.


Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to execute arbitrary PHP code by writing a file with a PHP extension via the \docid\ and \content\ parameters and accessing it in the traversed directory.


/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory but it does not properly neutralize get_file sequences such as \..\ that can resolve to a location that is outside of that directory aka Directory Traversal.


The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.


An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty because there is a classloader vulnerability that can allow a reverse file traversal route in AssetPipelineFilter.groovy or AssetPipelineFilterCore.groovy.


In blynk-server in Blynk before 0.39.7 Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning as demonstrated by reading the /etc/passwd file.


An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php.


An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.


Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2 5.3.1 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams which could be used to bypass the file extensions via not properly validating the path when exporting a particular XML file.


A potential Directory Traversal Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be remotely exploited to allow Directory Traversal.


Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.


Directory

traversal

vulnerability

in

Foscam

Cameras

Lite

and

with

firmware

and

earlier

and

and

earlier

and

and

earlier

Lite

and

Lite

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

allows

remote

attackers

to

delete

arbitrary

files

via

a

(dot

dot)

in

the

URI

path

component.


Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10 2.3.x before 2.3.7 2.4.x before 2.4.4 2.5.x before 2.5.1 and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.


ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.


An

issue

was

discovered

in

Sitecore

Sitecore.NET

rev.

Hotfix

and

above.

The

'Log

Viewer'

application

is

vulnerable

to

a

directory

traversal

attack

allowing

an

attacker

to

access

arbitrary

files

from

the

host

Operating

System

using

a

sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file=

URI.

Validation

is

performed

to

ensure

that

the

text

passed

to

the

'file'

parameter

correlates

to

the

correct

log

file

directory.

This

filter

can

be

bypassed

by

including

a

valid

log

filename

and

then

appending

a

traditional

'dot

dot'

style

attack.


uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option allowing directory traversal.


Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.


Directory traversal vulnerability in the Splunk Django App in Splunk Enterprise 6.0.x before 6.0.14 6.1.x before 6.1.13 6.2.x before 6.2.14 6.3.x before 6.3.10 6.4.x before 6.4.6 and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allows remote authenticated users to read arbitrary files via unspecified vectors.


Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.


The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree.


AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.


DISPUTED

The

component

for

Joomla!

has

Incorrect

Access

Control

with

directory

traversal

allowing

an

attacker

to

download

arbitrary

files

as

demonstrated

by

a

view=media&task=connector&cmd=file&target=l1_../configuration.php&download=1

request.

The

specific

pathname

../configuration.php

should

be

encoded

for

a

valid

attack.

NOTE:

the

vendor

disputes

this

issue

because

only

files

under

the

media-manager

path

can

be

downloaded

and

the

documentation

indicates

that

sensitive

information

does

not

belong

there.

Nonetheless

has

additional

blocking

of

.php

downloads.


An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for database access by deleting install.lock.


In

Go

before

and

before

the

\go

get\

command

is

vulnerable

to

directory

traversal

when

executed

with

the

import

path

of

a

malicious

Go

package

which

contains

curly

braces

(both

and

characters).

Specifically

it

is

only

vulnerable

in

GOPATH

mode

but

not

in

module

mode

(the

distinction

is

documented

at

The

attacker

can

cause

an

arbitrary

filesystem

write

which

can

lead

to

code

execution.


HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter.


Rubedo

through

contains

a

Directory

Traversal

vulnerability

in

the

theme

component

allowing

unauthenticated

attackers

to

read

and

execute

arbitrary

files

outside

of

the

service

root

path

as

demonstrated

by

a

URI.


The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Directory Traversal.


A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path.


The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.


It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document which when opened by LibreOffice would execute a Python method from a script in any arbitrary file system location specified relative to the LibreOffice install location.


Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.


An issue was discovered in SeaCMS through 6.61. adm1n/admin_database.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting install_lock.txt.


Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter.


An

issue

was

discovered

in

damiCMS

There

is

Directory

Traversal

via

characters

in

the

s

parameter

to

admin.php

as

demonstrated

by

an

admin.php?s=Tpl/Add/id/c:|windows|win.ini

URI.


The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.


Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal.


idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal resulting in execution of arbitrary PHP code from a ZIP file.


Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.


Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to download sensitive files from the server.


common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow leading to the writing of files to arbitrary locations.


Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however this computation occurs on the client side and the computation details can be easily determined because the product's source code is available.


bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with \Content-Type: application/octet-stream\) to ../media/images/ via the admin/index.php?mode=tools&page=upload URI aka directory traversal.


DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter (the attacker must provide the correct fileOrgName value).


ACS

Advanced

Comment

System

is

affected

by

Directory

Traversal

via

an

advanced_component_system/index.php?ACS_path=..%2f

URI.

NOTE:

this

might

be

the

same

as


Sky File v2.1.0 contains a directory traversal vulnerability in the FTP server which allows attackers to access sensitive data and files via 'null' path commands.


Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain an issue in the path parameter of the `list` and `download` module which allows attackers to perform a directory traversal via a change to the path variable to request the local list command.


An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via admin/inst_lang.php.


Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3 a directory traversal check is performed on the input path parameter but the startsWith function can be used to bypass it.


Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter.


An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the backend the attacker can overwrite some files such as ftl files .bashrc files in the user directory and finally get the permissions of the operating system.


An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background a directory traversal check is performed on the input path parameter but the startsWith function can be used to bypass it.


Directory Traversal vulnerability exists in FusionPBX 4.5.7 which allows a remote malicious user to create folders via the folder variale to app\\edit\\foldernew.php.


There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user when deleting their backup files to delete any files on the system through directory traversal.


BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter.


autoar-extractor.c in GNOME gnome-autoar through 0.2.4 as used by GNOME Shell Nautilus and other software allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.


fr-archive-libarchive.c in GNOME file-roller through 3.38.0 as used by GNOME Shell and other software allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.


Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links a related issue to CVE-2020-28948.


Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.


A local arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application and if a victim were to install this apk the attacker could perform a directory traversal execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.


AnyShare

Cloud

allows

authenticated

directory

traversal

to

read

files

as

demonstrated

by

the

interface/downloadwithpath/downloadfile/?filepath=/etc/passwd

URI.


SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list.


AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal as demonstrated by reading the /etc/passwd file.


Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to compromise a victim's privacy.


Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.


An

issue

in

/admin/index.php?n=system&c=filept&a=doGetFileList

of

Metinfo

allows

attackers

to

perform

a

directory

traversal

and

access

sensitive

information.


Directory

Traversal

in

Skycaiji

allows

remote

attackers

to

obtain

sensitive

information

via

the

component

'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpStudy%5CWWW%5Cindex.php'.


Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /admin/ajax/upload-profile-picture.


An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the \Send me a copy\ option to receive any files of the filesystem via email.


The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal.


An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69 a remote attacker can perform a directory traversal and obtain operating system files via a TFTP GET request as demonstrated by reading /etc/passwd or /proc/version.


Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php.


Unathenticated directory traversal in the ReceiverServlet class doGet() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.


Unathenticated directory traversal in the DownloadServlet class execute() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.


Icinga Icinga Web2 2.0.0 through 2.6.4 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4 v2.7.4 and v2.8.2.


NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.


An issue was discovered in Hyland OnBase through 16.0.2.83 and below 17.0.2.109 and below 18.0.0.37 and below 19.8.16.1000 and below and 20.3.10.1000 and below. Directory traversal exists for reading files as demonstrated by the FileName parameter.


Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files if httpd in the inets application is used.


An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.


Setelsa

Conacwin

is

vulnerable

to

a

local

file

inclusion

vulnerability.

This

vulnerability

allows

a

remote

unauthenticated

attacker

to

read

internal

files

on

the

server

via

an

http:IP:PORT/../../path/file_to_disclose

Directory

Traversal

URI.

NOTE:

The

manufacturer

indicated

that

the

affected

version

does

not

exist.

Furthermore

they

indicated

that

they

detected

this

problem

in

an

internal

audit

more

than

years

ago

and

fixed

it

in


ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.


An issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. Directory traversal exists for writing to files as demonstrated by the FileName parameter.


In CommCell in Commvault before 14.68 15.x before 15.58 16.x before 16.44 17.x before 17.29 and 18.x before 18.13 Directory Traversal can occur such that an attempt to view a log file can instead view a file outside of the log-files folder.


A

vulnerability

was

discovered

in

the

filename

parameter

in

pathindex.php?r=cms-backend/attachment/delete&sub=&filename=../../../../111.txt&filetype=image/jpeg

of

the

master

version

of

RKCMS.

This

vulnerability

allows

for

an

attacker

to

perform

a

directory

traversal

via

a

crafted

.txt

file.


Incorrect Access Control in the FileEditor (/Admin/Views/FileEditor/) in FlexDotnetCMS before v1.5.11 allows an authenticated remote attacker to read and write to existing files outside the web root. The files can be accessed via directory traversal i.e. by entering a .. (dot dot) path such as ..\\..\\..\\..\\..\\<file> in the input field of the FileEditor. In FlexDotnetCMS before v1.5.8 it is also possible to access files by specifying the full path (e.g. C:\\<file>). The files can then be edited via the FileEditor.


Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.


A vulnerability in Cisco Security Manager could allow an unauthenticated remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to an affected device. An attacker could exploit this vulnerability by sending a crafted request to the affected device. A successful exploit could allow the attacker to download arbitrary files from the affected device.


A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system.


The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows when using the built-in HTTP form-based file upload mechanism via the mg_handle_form_request API. Web applications that use the file upload form handler and use parts of the user-controlled filename in the output path are susceptible to directory traversal


An issue was discovered on Samsung mobile devices with O(8.x) P(9.0) and Q(10.0) software. Sticker Center allows directory traversal for an unprivileged process to read arbitrary files. The Samsung ID is SVE-2020-18433 (October 2020).


Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.


dotCMS before 5.2.4 is vulnerable to directory traversal leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally attackers can upload temporary files (e.g. .jsp files) into /webapps/ROOT/assets/tmp_upload which can lead to remote command execution (with the permissions of the user running the dotCMS application).


A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system. This can be used to identify configuration settings password hashes for built-in accounts and the cleartext password for remote configuration of the device through the WebUI.


In kerfuffle/jobs.cpp in KDE Ark before 20.08.0 a crafted archive can install files outside the extraction directory via ../ directory traversal.


In tgstation-server 4.4.0 and 4.4.1 an authenticated user with permission to download logs can download any file on the server machine (accessible by the owner of the server process) via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files however.


A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able to use startup menu directory via directory traversal for automatic execution. The victim user need to reboot however.


tftp.c in libslirp 4.1.0 as used in QEMU 4.2.0 does not prevent ..\\ directory traversal on Windows.


GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.


All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.


All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.


A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.


Zyxel Armor X1 WAP6806 1.00(ABAL.6)C0 devices allow Directory Traversal via the images/eaZy/ URI.


An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP aka MMSA-2020-0014.


Spring Cloud Config versions 2.2.x prior to 2.2.3 versions 2.1.x prior to 2.1.9 and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafted URL that can lead to a directory traversal attack.


Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series) GROWI versions prior to v4.1.12 (v4.1 Series) and GROWI v3 series and earlier GROWI versions prior to v4.2.3 (v4.2 Series) GROWI versions prior to v4.1.12 (v4.1 Series) and GROWI v3 series and earlier allows remote attackers to alter the data by uploading a specially crafted file.


Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50 CENTUM VP (includes CENTUM VP Small Basic) R4.01.00 to R6.07.00 B/M9000CS R5.04.01 to R5.05.01 and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to create or overwrite arbitrary files and run arbitrary commands via unspecified vectors.


Spring Cloud Config versions 2.2.x prior to 2.2.2 versions 2.1.x prior to 2.1.7 and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafted URL that can lead a directory traversal attack.


In uftpd before 2.11 it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in compose_abspath(). This has been fixed in version 2.11


Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.


Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station.


Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.


The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 3.4.x prior to 3.4.4 and 4.0.x prior to 4.0.1 allows for executing files through directory traversal. An authenticated SD-WAN Orchestrator user is able to traversal directories which may lead to code execution of files.


tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive.


Some devices of Thales DIS (formerly Gemalto formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check of the internal flash file system can be circumvented. This flash file system can store application-specific data and data needed for customer Java applications TLS and OTAP (Java over-the-air-provisioning) functionality. The affected products and releases are: BGS5 up to and including SW RN 02.000 / ARN 01.001.06 EHSx and PDSx up to and including SW RN 04.003 / ARN 01.000.04 ELS61 up to and including SW RN 02.002 / ARN 01.000.04 ELS81 up to and including SW RN 05.002 / ARN 01.000.04 PLS62 up to and including SW RN 02.000 / ARN 01.000.04


In Ortus TestBox 2.4.0 through 4.1.0 unvalidated query string parameters to test-browser/index.cfm allow directory traversal.


An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the server via Directory Traversal or possibly have unspecified other impact.


Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php.


In

Wiki.js

before

version

directory

traversal

outside

of

Wiki.js

context

is

possible

when

a

storage

module

with

local

asset

cache

fetching

is

enabled.

A

malicious

user

can

potentially

read

any

file

on

the

file

system

by

crafting

a

special

URL

that

allows

for

directory

traversal.

This

is

only

possible

when

a

storage

module

implementing

local

asset

cache

(e.g

Local

File

System

or

Git)

is

enabled

and

that

no

web

application

firewall

solution

(e.g.

cloudflare)

strips

potentially

malicious

URLs.

Commit

fixes

this

vulnerability

by

sanitizing

the

path

before

it

is

passed

on

to

the

storage

module.

The

sanitization

step

removes

any

directory

traversal

(e.g.

and

sequences

as

well

as

invalid

filesystem

characters

from

the

path.

As

a

workaround

disable

any

storage

module

with

local

asset

caching

capabilities

such

as

Local

File

System

and

Git.


An issue was discovered on Samsung mobile devices with O(8.x) P(9.0) and Q(10.0) software. StickerProvider allows directory traversal for access to system files. The Samsung ID is SVE-2020-17665 (July 2020).


An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.


A path traversal vulnerability CWE-22 in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory traversal character sequences to add/delete the files of the server via the name parameter of Deployment Packages.


Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.


The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.


The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot directory via directory traversal.


The documentation component in i-net Clear Reports 16.0 to 19.2 HelpDesk 8.0 to 8.3 and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbitrary system files and directories on the target server via Directory Traversal.


UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerability by manipulating variables that reference files and by doing this achieve access to files and directories outside the web root folder. An attacker may access arbitrary files and directories stored in the file system but integrity of the files are not jeopardized as attacker have read access rights only.


fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.


A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.


SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g. a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.


HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.


A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions to read and write arbitrary files in the Linux file system. This issue affects: GateManager all versions prior to 9.2c.


In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7 insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request aka CID-2896c93811e3. For example an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.


A Directory Traversal vulnerability exists in ATX miniCMTS200a Broadband Gateway through 2.0 and Pico CMTS through 2.0. Successful exploitation of this vulnerability would allow an unauthenticated attacker to retrieve administrator credentials by sending a malicious POST request.


Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read edit or delete any file within the filesystem via the (1) filename parameter to /tos/index.php?editor/fileGet Event parameter to /include/ajax/logtable.php or opt parameter to /include/core/index.php.


A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when sending specially crafted docx xlsx and pptx files as attachments to messages.


LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal a different vulnerability than CVE-2020-9423 and CVE-2020-10365.


A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to list the content of arbitrary server directories accessible to the user running the application.


A directory traversal on the /admin/search_by.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to read arbitrary server files accessible to the user running the application.


GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability leading to arbitrary file read.


A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software Cisco TelePresence Codec (TC) Software and Cisco RoomOS Software could allow an authenticated remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the xAPI of the affected software. An attacker could exploit this vulnerability by sending a crafted request to the xAPI. A successful exploit could allow the attacker to read and write arbitrary files in the system. To exploit this vulnerability an attacker would need either an In-Room Control or administrator account.


A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences. An exploit could allow the attacker to view or delete arbitrary files on the targeted system. When the device is reloaded after exploitation of this vulnerability any files that were deleted are restored. The attacker can only view and delete files within the web services file system. This file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability can not be used to obtain access to ASA or FTD system files or underlying operating system (OS) files. Reloading the affected device will restore all files within the web services file system.


A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated remote attacker with administrative privileges to conduct directory traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to read files on the underlying operating system with root privileges. To exploit this vulnerability the attacker would need to have administrative privileges on the affected system.


A vulnerability in the archive utility of Cisco Data Center Network Manager (DCNM) could allow an authenticated remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to a lack of proper input validation of paths that are embedded within archive files. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to write arbitrary files in the system with the privileges of the logged-in user.


A vulnerability in a specific REST API of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the API. An attacker with a low-privileged account could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to read arbitrary files on the affected system.


A vulnerability in the configuration restore feature of Cisco Nexus Data Broker software could allow an unauthenticated remote attacker to perform a directory traversal attack on an affected device. The vulnerability is due to insufficient validation of configuration backup files. An attacker could exploit this vulnerability by persuading an administrator to restore a crafted configuration backup file. A successful exploit could allow the attacker to overwrite arbitrary files that are accessible through the affected software on an affected device.


A vulnerability in the Tool for Auto-Registered Phones Support (TAPS) of Cisco Unified Communications Manager (UCM) and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the TAPS interface of the affected device. An attacker could exploit this vulnerability by sending a crafted request to the TAPS interface. A successful exploit could allow the attacker to read arbitrary files in the system.


A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directory permissions. An attacker could exploit this vulnerability by using capabilities that are not controlled by the role-based access control (RBAC) mechanisms of the software. A successful exploit could allow the attacker to overwrite files on an affected device.


A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.


A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to the affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system.


A vulnerability in the web management interface of Cisco SD-WAN vManage Software could allow an authenticated remote attacker to conduct directory traversal attacks and obtain read and write access to sensitive files on a targeted system. The vulnerability is due to a lack of proper validation of files that are uploaded to an affected device. An attacker could exploit this vulnerability by uploading a crafted file to an affected system. An exploit could allow the attacker to view or modify arbitrary files on the targeted system.


Solis

Miolo

allows

index.php?module=install&action=view&item=

Directory

Traversal.


BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to bigbluebutton.properties. NOTE: this issue exists because of an ineffective mitigation to CVE-2020-12112 in which there was an attempted fix within an NGINX configuration file without considering that the relevant part of NGINX is case-insensitive.


Gnuteca 3.8 allows file.php?folder=/&file= Directory Traversal.


The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member when a symlink is used because of Directory Traversal.


Gurbalib through 2020-04-30 allows lib/cmds/player/help.c directory traversal for reading administrative paths.


DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.


TP-Link

Omada

Controller

Software

allows

Directory

Traversal

for

reading

arbitrary

files

via

com.tp_link.eap.web.portal.PortalController.getAdvertiseFile

in


Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.


An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an authenticated user to change the filename value (in the POST method) from the original filename to achieve directory traversal via a ../ sequence and for example obtain a complete directory listing of the machine.


TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal.


Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.


An

issue

was

discovered

in

Navigate

CMS

through

It

allows

Directory

Traversal

because

mishandles

and

substrings.


In Apache Ambari versions 2.6.2.2 and earlier malicious users can construct file names for directory traversal and traverse to other directories to download files.


iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal.


OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task.


PlayTube

allows

disclosure

of

user

details

via

ajax.php?type=../admin-panel/autoload&page=manage-users

directory

traversal

aka

local

file

inclusion.


openSIS through 7.4 allows Directory Traversal.


Intelbras

TIP

TIP

LITE

and

TIP

devices

allow

cgi-bin/cgiServer.exx?page=../

Directory

Traversal.


In Zoho ManageEngine OpManager before 125144 when <cachestart> is used directory traversal validation can be bypassed.


Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) 8.4 SP1 and earlier and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to read arbitrary files via unspecified vectors.


An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The directory traversal/file upload error allows an attacker to upload and unpack a zip file.


An issue was discovered in Pivotal Spring Framework before 3.2.18 4.2.x before 4.2.9 and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.


A Directory Traversal vulnerability in DashboardFileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload a malicious file in a section of the file system where it can be executed.


Directory

traversal

vulnerability

in

Plone

CMS

through

and

through

allows

remote

administrators

to

read

arbitrary

files

via

a

(dot

dot)

in

the

path

parameter

in

a

getFile

action

to

Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.


The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal.


Directory

traversal

vulnerability

in

the

class

in

in

the

upgrade

package

uploader

in

WordPress

before

allows

remote

authenticated

users

to

access

arbitrary

files

via

a

crafted

urlholder

parameter.


In Opsview Monitor Pro (Prior to 5.1.0.162300841 prior to 5.0.2.27475 prior to 4.6.4.162391051 and 4.5.x without a certain 2016 security patch) an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding bypass %252f instead of /.


Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id (aka dir) parameter related to browser/directory/getlist.


The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.


The ebook-download plugin before 1.2 for WordPress has directory traversal.


The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.


Directory traversal vulnerability in scgi-bin/platform.cgi on NETGEAR FVS336Gv3 FVS318N FVS318Gv2 and SRX5308 devices with firmware before 4.3.3-8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the thispage parameter as demonstrated by reading the /etc/shadow file.


Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is exploitable via the URL path in GET requests.


The XMLUI feature in DSpace before 3.6 4.x before 4.5 and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname as demonstrated by a themes/Reference/aa:etc/passwd URI.


Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter related to browser/directory/getfiles.


The

Xinha

plugin

in

Precurio

allows

Directory

Traversal

with

resultant

arbitrary

code

execution

via

because

ExtendedFileManager

can

be

used

to

rename

the

.htaccess

file

that

blocks

.php

uploads.


The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.


Directory

Traversal

exists

in

ATutor

before

via

the

icon

parameter

to

The

attacker

can

read

an

arbitrary

file

by

visiting

after

the

traversal

attack.


Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter related to browser/directory/remove.


ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.


osClass

allows

oc-admin/plugins.php

Directory

Traversal

via

the

plugin

parameter.

This

is

exploitable

for

remote

PHP

code

execution

because

an

administrator

can

upload

an

image

that

contains

PHP

code

in

the

EXIF

data

via


Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200 2.6 before build 2106 and 3.0 before build 1330 allow remote attackers to read and delete arbitrary files via the tmpfname parameter to (1) log_mgt_adhocquery_ajaxhandler.php (2) log_mgt_ajaxhandler.php (3) log_mgt_ajaxhandler.php or (4) tf parameter to wcs_bwlists_handler.php.


Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter aka POINTYFEATHER.


Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote authenticated users to read arbitrary files via a crafted pathname in an HTTP request aka Bug ID CSCuz27255.


A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image triggering the vulnerability.


Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource.


Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows remote attackers to read arbitrary files via unspecified vectors.


Unspecified vulnerability in the NetBeans component in Oracle Fusion Middleware 8.1 allows local users to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information is from the October 2016 CPU. Oracle has not commented on third-party claims that this issue is a directory traversal vulnerability which allows local users with certain permissions to write to arbitrary files and consequently gain privileges via a .. (dot dot) in a archive entry in a ZIP file imported as a project.


Directory

traversal

vulnerability

in

the

charting

component

in

Symantec

Messaging

Gateway

before

allows

remote

authenticated

users

to

read

arbitrary

files

via

a

(dot

dot)

in

the

sn

parameter

to

brightmail/servlet/com.ve.kavachart.servlet.ChartStream.


Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14.


Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI.


Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. (dot dot) in a filename within a multipart/form-data POST request to a LiveTime.woa URL.


Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \\ (backslash) characters which allows attackers to conduct directory traversal attacks via a file: URL related to net/base/escape.cc and net/base/filename_util.cc.


Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps a different vulnerability than CVE-2016-0477 and CVE-2016-0478. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet which allows remote attackers to read arbitrary files via directory traversal sequences in the reportName parameter.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps a different vulnerability than CVE-2016-0476 and CVE-2016-0478. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet which allows remote attackers to read arbitrary files via directory traversal sequences in the (1) repository (2) workspace or (3) scenario parameter.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps a different vulnerability than CVE-2016-0480 CVE-2016-0481 CVE-2016-0482 and CVE-2016-0485. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet which allows remote attackers to read arbitrary files via directory traversal sequences in the exportFileName parameter.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps a different vulnerability than CVE-2016-0480 CVE-2016-0481 CVE-2016-0485 and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet which allows remote attackers to read arbitrary files via directory traversal sequences in the file parameter.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps a different vulnerability than CVE-2016-0487. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the UploadServlet servlet which allows remote attackers to upload and execute arbitrary files via directory traversal sequences in a filename header.


Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1 4.0.x and 4.1.x before 4.1.14.1 4.2.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet which allows remote attackers to read arbitrary files via directory traversal sequences in the scriptPath parameter.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps a different vulnerability than CVE-2016-0481 CVE-2016-0482 CVE-2016-0485 and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet which allows remote attackers to read arbitrary files via directory traversal sequences in the TMAPReportImage parameter.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps a different vulnerability than CVE-2016-0480 CVE-2016-0481 CVE-2016-0482 and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet which allows remote attackers to read arbitrary files via directory traversal sequences in the reportName parameter.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps a different vulnerability than CVE-2016-0480 CVE-2016-0482 CVE-2016-0485 and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet which allows remote attackers to read arbitrary files via directory traversal sequences in the scheduleReportName parameter.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote authenticated users to affect confidentiality integrity and availability via unknown vectors related to Test Manager for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the ActionServlet servlet which allows remote authenticated users to upload and execute arbitrary files via directory traversal sequences in the tempfilename parameter in a ReportImage action.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps a different vulnerability than CVE-2016-0476 and CVE-2016-0477. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet which allows remote attackers to read arbitrary files via directory traversal sequences in the scriptName parameter.


Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog aka SAP Security Note 2230978.


Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.


Directory traversal vulnerability in the file-download configuration file in the management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 and Symantec Workspace Virtualization (SWV) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 allows remote authenticated users to read unspecified application files via unknown vectors.


Directory traversal vulnerability in the wallpaper parsing functionality in Barco ClickShare CSC-1 devices with firmware before 01.09.03 CSM-1 devices with firmware before 01.06.02 and CSE-200 devices with firmware before 01.03.02 allows remote attackers to read /etc/shadow via unspecified vectors.


Directory traversal vulnerability in (1) usercp_register.php and (2) usercp_avatar.php for phpBB 2.0.11 and possibly other versions with gallery avatars enabled allows remote attackers to delete (unlink) arbitrary files via \/../\ sequences in the avatarselect parameter.


Multiple directory traversal vulnerabilities in ArGoSoft Mail Server 1.8.7.3 allow remote authenticated users to read delete or upload arbitrary files via a .. (dot dot) in (1) the filename of an e-mail attachment (2) the _msgatt.rec file (3) and the /msg /delete /folderadd and /folderdelete operations for the Folder parameter.


Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via \.../....///\ sequences which are not properly cleansed by regular expressions that are intended to remove \../\ and \./\ sequences.


Directory traversal vulnerability in HolaCMS 1.4.9-1 allows remote attackers to overwrite arbitrary files via a \holaDB/votes\ followed by a .. (dot dot) in the vote_filename parameter which bypasses the check by HolaCMS to ensure that the file is in the holaDB/votes directory.


Multiple directory traversal vulnerabilities in sitenfo.sh sitezipchk.sh and siteziplist.sh in Glftpd 1.26 to 2.00 allow remote authenticated users to (1) determine the existence of arbitrary files (2) list files in restricted directories or (3) read arbitrary files from within ZIP or gzip files via .. (dot dot) sequences and globbing (\*\) characters in a SITE NFO command.


Directory traversal vulnerability in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to delete arbitrary files via a Real Metadata Packages (RMP) file with a FILENAME tag containing .. (dot dot) sequences in a filename that ends with a ? (question mark) and an allowed file extension (e.g. .mp3) which bypasses the check for the file extension.


Multiple directory traversal vulnerabilities in Magic Winmail Server 4.0 Build 1112 allow remote attackers to (1) upload arbitrary files via certain parameters to upload.php or (2) read arbitrary files via certain parameters to download.php and remote authenticated users to read create or delete arbitrary directories and files via the IMAP commands (3) CREATE (4) EXAMINE (5) SELECT or (6) DELETE.


Directory traversal vulnerability in DeskNow Mail and Collaboration Server 2.5.12 allows remote attackers to (1) upload and possibly execute files outside the directory via the AttachmentsKey parameter to attachment.do as demonstrated using JSP pages or (2) delete arbitrary files via the select_file parameter to file.do.


Multiple directory traversal vulnerabilities in AZ Bulletin board (AZbb) before 1.0.08 allow (1) remote authenticated users with administrative privileges to delete arbitrary files via a .. (dot dot) in the URL to admin_avatar.php or admin_attachment.php or (2) remote attackers to enumerate files via a .. (dot dot) in the attachment parameter to attachment.php which displays a different message when a file exists or does not exist.


The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an \incorrect optimization\ that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file probably involving \/../\ sequences with a leading \/\.