Sign in Sign up
JA · EN · FR
SecPulse

Path Traversal

⚔️ Attack Types Related 2,053
slug: path-traversal

Explanation

パストラバーサルは「ファイル名を指定する箇所に `../../../etc/passwd` のような文字列を入れて、本来アクセスできないファイルを読み出す」攻撃です。 ファイルダウンロード機能や画像表示機能でよく見られます。 対策は「ユーザー入力のファイル名を、必ずホワイトリスト・固定ディレクトリに制限する」こと。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slipにより、サーバー上の任意の場所にファイル書き込みされる脆弱性。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Privilege Escalation1503 Cross-Site Request Forgery1068 Server-Side Request Forgery856 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 2,054

Image ID Title
CVE-2026-59976 Path Traversal in ConvertX (CVE-2026-59976)
CVE-2026-103061 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows…
CVE-2026-109247 Path Traversal in FreeRDP (CVE-2026-109247)
CVE-2026-109354 Path Traversal in LibreNMS (CVE-2026-109354)
CVE-2026-109309 Path Traversal in SiYuan (CVE-2026-109309)
CVE-2026-96612 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a…
CVE-2026-103060 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a…
CVE-2026-103537 Code Injection in Thelia (CVE-2026-103537)
CVE-2026-103535 Code Injection in Thelia (CVE-2026-103535)
CVE-2026-78355 Path Traversal in OTRS SendSupportBundle functionality (CVE-2026-78355)
CVE-2026-87690 The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a...
CVE-2026-21137 Path Traversal in Smart Switch (CVE-2026-21137)
CVE-2026-21133 Path Traversal in Samsung Flow (CVE-2026-21133)
CVE-2026-108791 Path Traversal in westboy CicadasCMS (CVE-2026-108791)
CVE-2026-108790 Path Traversal in westboy CicadasCMS (CVE-2026-108790)
CVE-2026-108980 Vulnerability in Blinko (CVE-2026-108980)
CVE-2026-108772 Path Traversal in bleenco abstruse (CVE-2026-108772)
CVE-2026-108902 Path Traversal in pH7Builder (CVE-2026-108902)
CVE-2026-108567 Path Traversal in InstantSoft icms2 (CVE-2026-108567)
CVE-2026-108543 Path Traversal in ag2ai ag2 (CVE-2026-108543)
CVE-2026-108544 Path Traversal in Lippu Docx Reader Office Viewer App (CVE-2026-108544)
CVE-2026-108603 Path Traversal in slide-maker (CVE-2026-108603)
CVE-2026-108597 Path Traversal in Cohere Python SDK (CVE-2026-108597)
CVE-2026-105892 Path Traversal in rtMedia for WordPress, BuddyPress and bbPress (CVE-2026-105892)
CVE-2026-108585 Path Traversal in argocd-mcp (CVE-2026-108585)
CVE-2026-97348 Path Traversal in SiteOrigin Widgets Bundle (WordPress plugin) (CVE-2026-97348)
CVE-2026-104763 Path Traversal in WordPress (CVE-2026-104763)
CVE-2026-108158 plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard...
CVE-2026-104081 Path Traversal in KodExplorer (CVE-2026-104081)
CVE-2026-103412 Path Traversal in Apache (CVE-2026-103412)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details