Sign in Sign up
JA · EN · FR
SecPulse

Path Traversal

⚔️ Attack Types Related 2,053
slug: path-traversal

Explanation

パストラバーサルは「ファイル名を指定する箇所に `../../../etc/passwd` のような文字列を入れて、本来アクセスできないファイルを読み出す」攻撃です。 ファイルダウンロード機能や画像表示機能でよく見られます。 対策は「ユーザー入力のファイル名を、必ずホワイトリスト・固定ディレクトリに制限する」こと。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slipにより、サーバー上の任意の場所にファイル書き込みされる脆弱性。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Privilege Escalation1503 Cross-Site Request Forgery1068 Server-Side Request Forgery856 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 2,058

Image ID Title
CVE-2026-65765 Path Traversal in Phoca Commander 1.0.0-6.1.1 (CVE-2026-65765)
CVE-2026-64400 Vulnerability in Linux kernel (CVE-2026-64400)
CVE-2026-14955 Path Traversal in Checkout Field Editor for WooCommerce (WordPress plugin) (CVE-2026-14955)
CVE-2026-61632 Path Traversal in pymdown-extensions (CVE-2026-61632)
CVE-2026-66004 Path Traversal in blender-mcp (CVE-2026-66004)
CVE-2026-66007 Path Traversal in datasets (CVE-2026-66007)
CVE-2026-66140 Vulnerability in Exim (CVE-2026-66140)
CVE-2026-15420 Path Traversal in WordPress (CVE-2026-15420)
CVE-2026-16767 Path Traversal in Ne-Lexa php-zip (CVE-2026-16767)
CVE-2026-65694 Path Traversal in Microweber CMS (CVE-2026-65694)
CVE-2026-65920 Path Traversal in Diffusers (CVE-2026-65920)
CVE-2026-65700 Path Traversal in h2oGPT (CVE-2026-65700)
CVE-2026-65701 SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal...
CVE-2026-65702 Path Traversal in Vanna (CVE-2026-65702)
CVE-2026-65698 Path Traversal in Void (CVE-2026-65698)
CVE-2026-65695 Path Traversal in Office-Word-MCP-Server (CVE-2026-65695)
CVE-2026-65687 Path Traversal in Bold Reports Standalone Report Designer (CVE-2026-65687)
CVE-2026-65690 Path Traversal in Bold Reports Standalone Report Designer (CVE-2026-65690)
CVE-2026-65689 Path Traversal in Bold Reports Standalone Report Designer (CVE-2026-65689)
CVE-2026-65688 Path Traversal in Bold Reports Standalone Report Designer (CVE-2026-65688)
CVE-2026-65896 Vulnerability in Grav API Plugin (CVE-2026-65896)
CVE-2026-65607 Path Traversal in SiYuan (CVE-2026-65607)
CVE-2026-15786 Path Traversal in WordPress (CVE-2026-15786)
CVE-2026-64872 Custom purge and log paths could escape the site webroot directory.
CVE-2026-16078 Path Traversal in WordPress (CVE-2026-16078)
CVE-2026-15074 Path Traversal in @fastify/static (CVE-2026-15074)
CVE-2026-16653 Path Traversal in boazsegev facil.io (CVE-2026-16653)
CVE-2025-60835 Vulnerability in IZArc (CVE-2025-60835)
CVE-2026-13186 Path Traversal in Progress Telerik Ui For Aspnet Ajax (CVE-2026-13186)
CVE-2026-65600 Path Traversal in github.com/traefik/traefik/v2 (CVE-2026-65600)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details