Path traversal vulnerabilities
A file path built from user input escapes its intended folder, letting an attacker read or overwrite files elsewhere on the system.
Path traversal in numbers
sbomify tracks 19,236 path traversal vulnerabilities. Most are found in web application (31%), server software (22%) and cms plugin (17%).
How to fix path traversal vulnerabilities
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it.
Most exploited path traversal vulnerabilities
- CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal
- CVE-2026-48282 Adobe ColdFusion Path Traversal
- CVE-2026-34909 Ubiquiti UniFi OS Path Traversal
- CVE-2025-24813 Apache Tomcat Path Equivalence
- CVE-2021-41277 Metabase GeoJSON API Local File Inclusion
- CVE-2015-3306 ProFTPD Improper Access Control
- CVE-2019-11510 Ivanti Pulse Connect Secure Arbitrary File Read
- CVE-2018-18809 TIBCO JasperReports Library Directory Traversal
- CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal
- CVE-2026-104286 Fortinet FortiMail Path Traversal
- CVE-2026-93616 Check Point Multiple Products Path Traversal
- CVE-2026-59310 Broadcom VMware vCenter Path Traversal
Recently published
- CVE-2026-108120 path traversal inKoozali - SME Server
- CVE-2026-108762 Apache Kylin: delete metadata backup path-confinement bypass
- CVE-2026-111045 CLI Bridge: High-severity sandbox escape via dangling symlink
- CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
- CVE-2026-111398 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability
- CVE-2026-111757 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.