# Path traversal

A file path built from user input escapes its intended folder, letting an attacker read or overwrite files elsewhere on the system.

How to fix: Upgrade, and resolve every user-supplied path against an allowed base folder before opening it.


- [CVE-2026-85706](https://insights.sbomify.com/CVE-2026-85706/): GitLab Community Edition and Enterprise Edition Path Traversal (critical 10.0, exploited in the wild)
- [CVE-2026-48282](https://insights.sbomify.com/CVE-2026-48282/): Adobe ColdFusion Path Traversal (critical 10.0, exploited in the wild)
- [CVE-2026-34909](https://insights.sbomify.com/CVE-2026-34909/): Ubiquiti UniFi OS Path Traversal (critical 10.0, exploited in the wild)
- [CVE-2025-24813](https://insights.sbomify.com/CVE-2025-24813/): Apache Tomcat Path Equivalence (critical 10.0, exploited in the wild)
- [CVE-2021-41277](https://insights.sbomify.com/CVE-2021-41277/): Metabase GeoJSON API Local File Inclusion (critical 10.0, exploited in the wild)
- [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2019-11510](https://insights.sbomify.com/CVE-2019-11510/): Ivanti Pulse Connect Secure Arbitrary File Read (critical 9.9, exploited in the wild)
- [CVE-2018-18809](https://insights.sbomify.com/CVE-2018-18809/): TIBCO JasperReports Library Directory Traversal (critical 9.9, exploited in the wild)
- [CVE-2026-76519](https://insights.sbomify.com/CVE-2026-76519/): Cisco Secure Email Gateway Relative Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2026-104286](https://insights.sbomify.com/CVE-2026-104286/): Fortinet FortiMail Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2026-93616](https://insights.sbomify.com/CVE-2026-93616/): Check Point Multiple Products Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2026-59310](https://insights.sbomify.com/CVE-2026-59310/): Broadcom VMware vCenter Path Traversal (critical 9.8, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/types/path-traversal/