CWE-35
AllowedPath Traversal: '.../...//'
Abstraction: Variant · Status: Incomplete
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
359 vulnerabilities reference this CWE, most recent first.
GHSA-PHV5-334H-MXCW
Vulnerability from github – Published: 2026-06-23 19:09 – Updated: 2026-06-23 19:09Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal
Summary
Myself and others have reported several RCE vulnerabilities to this project. However, due to the nature of the app, these are largely not of all that much value, as there is built-in functionality to run commands upon certain actions — i.e. RCE is by design.
With that in mind, I endeavored to find some sort of auth bypass, and was slightly successful.
When the admin password is set but the normal (surveillance) user password is left empty (the default), an unauthenticated attacker can exploit a path traversal vulnerability to read the motionEye configuration file from disk. This file contains the admin password as a SHA-1 hash, and that hash is accepted directly as a signing key for admin API requests — no cracking required. The result is full admin access from zero credentials.
This is a realistic scenario: many installations set an admin password to protect the settings UI but leave the normal user password empty so household members can view camera feeds without logging in.
Details
The vulnerability chains two independent issues:
1. Unauthenticated normal-user access when @normal_password is empty
In motioneye/handlers/base.py, lines 149-151:
# no authentication required for normal user
if not username and not normal_password:
return 'normal'
When @normal_password is empty (the default — see config.py line 2251: data.setdefault('@normal_password', '')), any request without a _username parameter is silently granted normal user access. This is by design for convenience, but it means all normal-level endpoints are fully unauthenticated.
2. Path traversal in MoviePlaybackHandler (and related handlers)
The movie playback handler at motioneye/handlers/movie_playback.py serves recorded video files. It accepts a filename in the URL path:
GET /movie/<camera_id>/playback/<filename>
The filename is passed to mediafiles.get_media_path() (mediafiles.py lines 497-500):
def get_media_path(camera_config, path, media_type):
target_dir = camera_config.get('target_dir')
full_path = os.path.join(target_dir, path)
return full_path
When path is an absolute path (e.g. /etc/motioneye/motion.conf), Python's os.path.join() discards target_dir entirely and returns the absolute path as-is. This would normally be caught by Tornado's StaticFileHandler path validation, but MoviePlaybackHandler explicitly overrides both safety checks (movie_playback.py lines 111-115):
def get_absolute_path(self, root, path):
return path
def validate_absolute_path(self, root, absolute_path):
return absolute_path
This allows reading any file on the filesystem that the motionEye process can access.
The same path traversal exists in the movie download, picture download, and picture preview handlers:
GET /movie/<camera_id>/download/<filename>GET /picture/<camera_id>/download/<filename>GET /picture/<camera_id>/preview/<filename>
3. Admin hash stored in a readable config file and accepted directly as a signing key
motionEye stores the admin password as SHA1(plaintext) in its main configuration file (motion.conf), written as a comment line:
# @admin_password 7b7d55439abccf4ae83047c1af2707e6eb6664db
The authentication code in base.py (lines 137-147) accepts signatures computed with either the raw stored hash or SHA1(stored_hash) as the signing key:
if username == admin_username and (
signature == utils.compute_signature(
self.request.method, self.request.uri, self.request.body, admin_password
)
or signature == utils.compute_signature(
self.request.method, self.request.uri, self.request.body, admin_hash
)
):
return 'admin'
Here admin_password is the raw value from the config file (the SHA-1 hash), and admin_hash is SHA1(admin_password) — a hash of the hash. Since the stored value is already a SHA-1 hash, and it is accepted directly as a valid signing key, there is no need to crack it. The attacker can use the stolen hash immediately.
Furthermore, the client-side JavaScript (static/js/main.js line 3631) computes sha1(plaintext_password) and stores it in the meye_password_hash cookie as the signing key. This is the same value as @admin_password in the config file.
PoC
Step 1 — Read the config file (unauthenticated, requires empty normal password):
GET /movie/1/playback//etc/motioneye/motion.conf HTTP/1.1
Host: target:8765
Response contains:
# @admin_username admin
# @admin_password 7b7d55439abccf4ae83047c1af2707e6eb6664db
Step 2 — Use the hash to become admin. In the browser console:
document.cookie = "meye_username=admin; path=/";
document.cookie = "meye_password_hash=7b7d55439abccf4ae83047c1af2707e6eb6664db; path=/";
location.reload();
The page reloads with full admin access. All subsequent requests are signed with the stolen hash.
Step 3 (optional) — Achieve RCE via the admin config API. The admin can set command_notifications_exec or command_storage_exec to arbitrary shell commands, which are written into motion event hooks and executed by the motion daemon:
POST /config/1/set HTTP/1.1
Content-Type: application/json
{"command_notifications_enabled": true, "command_notifications_exec": "touch /tmp/pwned", ...}
Impact
- Privilege escalation from zero credentials to full admin on any installation where the admin password is set but the normal user password is left empty (the default configuration).
- Arbitrary file read of any file readable by the motionEye process (typically running as
motionuser, orrooton motionEyeOS). This includes/etc/passwd,/etc/shadow(if permissions allow), SSH keys, and application secrets. - Full remote code execution — once admin access is obtained, the attacker can inject arbitrary shell commands via motion event hooks (
command_notifications_exec,command_storage_exec, orweb_hook_storage_url). Commands execute as the motion daemon user. - Realistic attack surface — this is a common configuration for home surveillance setups where the admin password protects settings but camera feeds are left open for household members. Public instances are discoverable via Shodan (
http.favicon.hash:1898775751).
Suggested Fix
- The path traversal should be fixed by validating that the resolved path stays within the camera's
target_dir. Do not overrideget_absolute_pathandvalidate_absolute_pathto bypass Tornado's built-in protections. At minimum, reject absolute paths in the filename parameter. - Consider warning users in the UI when the normal user password is empty, as this makes all normal-level endpoints (including the vulnerable file handlers) fully unauthenticated.
- The admin password hash should not be stored in a file that is served by the same file handlers used for media content. Alternatively, the
@metadata lines should be moved to a separate configuration file that is not within any camera's media path.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "motioneye"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.44.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-23T19:09:29Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "# Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal\n\n### Summary\n\nMyself and others have reported several RCE vulnerabilities to this project. However, due to the nature of the app, these are largely not of all that much value, as there is built-in functionality to run commands upon certain actions \u2014 i.e. RCE is by design.\n\nWith that in mind, I endeavored to find some sort of auth bypass, and was slightly successful.\n\nWhen the admin password is set but the normal (surveillance) user password is left empty (the default), an unauthenticated attacker can exploit a path traversal vulnerability to read the motionEye configuration file from disk. This file contains the admin password as a SHA-1 hash, and that hash is accepted directly as a signing key for admin API requests \u2014 no cracking required. The result is full admin access from zero credentials.\n\nThis is a realistic scenario: many installations set an admin password to protect the settings UI but leave the normal user password empty so household members can view camera feeds without logging in.\n\n### Details\n\nThe vulnerability chains two independent issues:\n\n**1. Unauthenticated normal-user access when `@normal_password` is empty**\n\nIn `motioneye/handlers/base.py`, lines 149-151:\n\n```python\n# no authentication required for normal user\nif not username and not normal_password:\n return \u0027normal\u0027\n```\n\nWhen `@normal_password` is empty (the default \u2014 see `config.py` line 2251: `data.setdefault(\u0027@normal_password\u0027, \u0027\u0027)`), any request without a `_username` parameter is silently granted `normal` user access. This is by design for convenience, but it means all normal-level endpoints are fully unauthenticated.\n\n**2. Path traversal in `MoviePlaybackHandler` (and related handlers)**\n\nThe movie playback handler at `motioneye/handlers/movie_playback.py` serves recorded video files. It accepts a filename in the URL path:\n\n```\nGET /movie/\u003ccamera_id\u003e/playback/\u003cfilename\u003e\n```\n\nThe filename is passed to `mediafiles.get_media_path()` (`mediafiles.py` lines 497-500):\n\n```python\ndef get_media_path(camera_config, path, media_type):\n target_dir = camera_config.get(\u0027target_dir\u0027)\n full_path = os.path.join(target_dir, path)\n return full_path\n```\n\nWhen `path` is an absolute path (e.g. `/etc/motioneye/motion.conf`), Python\u0027s `os.path.join()` discards `target_dir` entirely and returns the absolute path as-is. This would normally be caught by Tornado\u0027s `StaticFileHandler` path validation, but `MoviePlaybackHandler` explicitly overrides both safety checks (`movie_playback.py` lines 111-115):\n\n```python\ndef get_absolute_path(self, root, path):\n return path\n\ndef validate_absolute_path(self, root, absolute_path):\n return absolute_path\n```\n\nThis allows reading any file on the filesystem that the motionEye process can access.\n\nThe same path traversal exists in the movie download, picture download, and picture preview handlers:\n\n- `GET /movie/\u003ccamera_id\u003e/download/\u003cfilename\u003e`\n- `GET /picture/\u003ccamera_id\u003e/download/\u003cfilename\u003e`\n- `GET /picture/\u003ccamera_id\u003e/preview/\u003cfilename\u003e`\n\n**3. Admin hash stored in a readable config file and accepted directly as a signing key**\n\nmotionEye stores the admin password as `SHA1(plaintext)` in its main configuration file (`motion.conf`), written as a comment line:\n\n```\n# @admin_password 7b7d55439abccf4ae83047c1af2707e6eb6664db\n```\n\nThe authentication code in `base.py` (lines 137-147) accepts signatures computed with **either** the raw stored hash or `SHA1(stored_hash)` as the signing key:\n\n```python\nif username == admin_username and (\n signature == utils.compute_signature(\n self.request.method, self.request.uri, self.request.body, admin_password\n )\n or signature == utils.compute_signature(\n self.request.method, self.request.uri, self.request.body, admin_hash\n )\n):\n return \u0027admin\u0027\n```\n\nHere `admin_password` is the raw value from the config file (the SHA-1 hash), and `admin_hash` is `SHA1(admin_password)` \u2014 a hash of the hash. Since the stored value is already a SHA-1 hash, and it is accepted directly as a valid signing key, there is no need to crack it. The attacker can use the stolen hash immediately.\n\nFurthermore, the client-side JavaScript (`static/js/main.js` line 3631) computes `sha1(plaintext_password)` and stores it in the `meye_password_hash` cookie as the signing key. This is the same value as `@admin_password` in the config file.\n\n### PoC\n\n**Step 1** \u2014 Read the config file (unauthenticated, requires empty normal password):\n\n```\nGET /movie/1/playback//etc/motioneye/motion.conf HTTP/1.1\nHost: target:8765\n```\n\nResponse contains:\n\n```\n# @admin_username admin\n# @admin_password 7b7d55439abccf4ae83047c1af2707e6eb6664db\n```\n\n**Step 2** \u2014 Use the hash to become admin. In the browser console:\n\n```javascript\ndocument.cookie = \"meye_username=admin; path=/\";\ndocument.cookie = \"meye_password_hash=7b7d55439abccf4ae83047c1af2707e6eb6664db; path=/\";\nlocation.reload();\n```\n\nThe page reloads with full admin access. All subsequent requests are signed with the stolen hash.\n\n**Step 3 (optional)** \u2014 Achieve RCE via the admin config API. The admin can set `command_notifications_exec` or `command_storage_exec` to arbitrary shell commands, which are written into motion event hooks and executed by the motion daemon:\n\n```\nPOST /config/1/set HTTP/1.1\nContent-Type: application/json\n\n{\"command_notifications_enabled\": true, \"command_notifications_exec\": \"touch /tmp/pwned\", ...}\n```\n\n### Impact\n\n- **Privilege escalation from zero credentials to full admin** on any installation where the admin password is set but the normal user password is left empty (the default configuration).\n- **Arbitrary file read** of any file readable by the motionEye process (typically running as `motion` user, or `root` on motionEyeOS). This includes `/etc/passwd`, `/etc/shadow` (if permissions allow), SSH keys, and application secrets.\n- **Full remote code execution** \u2014 once admin access is obtained, the attacker can inject arbitrary shell commands via motion event hooks (`command_notifications_exec`, `command_storage_exec`, or `web_hook_storage_url`). Commands execute as the motion daemon user.\n- **Realistic attack surface** \u2014 this is a common configuration for home surveillance setups where the admin password protects settings but camera feeds are left open for household members. Public instances are discoverable via Shodan (`http.favicon.hash:1898775751`).\n\n### Suggested Fix\n\n1. The path traversal should be fixed by validating that the resolved path stays within the camera\u0027s `target_dir`. Do not override `get_absolute_path` and `validate_absolute_path` to bypass Tornado\u0027s built-in protections. At minimum, reject absolute paths in the filename parameter.\n2. Consider warning users in the UI when the normal user password is empty, as this makes all normal-level endpoints (including the vulnerable file handlers) fully unauthenticated.\n3. The admin password hash should not be stored in a file that is served by the same file handlers used for media content. Alternatively, the `@` metadata lines should be moved to a separate configuration file that is not within any camera\u0027s media path.",
"id": "GHSA-phv5-334h-mxcw",
"modified": "2026-06-23T19:09:29Z",
"published": "2026-06-23T19:09:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-phv5-334h-mxcw"
},
{
"type": "PACKAGE",
"url": "https://github.com/motioneye-project/motioneye"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal"
}
GHSA-PJX5-26HX-4CJ5
Vulnerability from github – Published: 2025-05-19 18:30 – Updated: 2026-04-01 18:35Path Traversal: '.../...//' vulnerability in bslthemes Tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a before 2.5.2.
{
"affected": [],
"aliases": [
"CVE-2025-27010"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-19T18:15:28Z",
"severity": "HIGH"
},
"details": "Path Traversal: \u0027.../...//\u0027 vulnerability in bslthemes Tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a before 2.5.2.",
"id": "GHSA-pjx5-26hx-4cj5",
"modified": "2026-04-01T18:35:11Z",
"published": "2025-05-19T18:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27010"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/theme/tastyc/vulnerability/wordpress-tastyc-2-5-2-local-file-inclusion-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PM93-MHPJ-X843
Vulnerability from github – Published: 2024-11-18 18:30 – Updated: 2024-11-18 18:30A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data. This vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-1132"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-18T16:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the API subsystem and in the web-management interface of Cisco\u0026nbsp;Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data.\nThis vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.Cisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
"id": "GHSA-pm93-mhpj-x843",
"modified": "2024-11-18T18:30:57Z",
"published": "2024-11-18T18:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1132"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-rce-dos-U2PsSkz3"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-dZRQE8Lc"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmaninfdis3-OvdR6uu8"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwanvman-infodis1-YuQScHB"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-ethernet-dos-HGXgJH8n"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-distupd-N87eB6Z3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PQ8X-V483-W8HJ
Vulnerability from github – Published: 2024-12-31 15:30 – Updated: 2026-04-01 18:32Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS allows Path Traversal.This issue affects WPLMS: from n/a before 1.9.9.5.
{
"affected": [],
"aliases": [
"CVE-2024-56045"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-31T14:15:24Z",
"severity": "CRITICAL"
},
"details": "Path Traversal: \u0027.../...//\u0027 vulnerability in VibeThemes WPLMS allows Path Traversal.This issue affects WPLMS: from n/a before 1.9.9.5.",
"id": "GHSA-pq8x-v483-w8hj",
"modified": "2026-04-01T18:32:54Z",
"published": "2024-12-31T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56045"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-unauthenticated-arbitrary-directory-deletion-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wplms-plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-unauthenticated-arbitrary-directory-deletion-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PW38-42W8-QM8M
Vulnerability from github – Published: 2023-04-24 15:30 – Updated: 2024-04-04 03:39In JetBrains Ktor before 2.3.0 path traversal in the resolveResource method was possible
{
"affected": [],
"aliases": [
"CVE-2022-48476"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-24T13:15:07Z",
"severity": "HIGH"
},
"details": "In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible\n",
"id": "GHSA-pw38-42w8-qm8m",
"modified": "2024-04-04T03:39:08Z",
"published": "2023-04-24T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48476"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q48Q-MRMP-GPX2
Vulnerability from github – Published: 2025-03-16 00:35 – Updated: 2026-04-28 21:35Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
{
"affected": [],
"aliases": [
"CVE-2025-26940"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-15T22:15:14Z",
"severity": "MODERATE"
},
"details": "Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.",
"id": "GHSA-q48q-mrmp-gpx2",
"modified": "2026-04-28T21:35:32Z",
"published": "2025-03-16T00:35:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26940"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/pie-register-premium/vulnerability/wordpress-pie-register-premium-plugin-3-8-3-2-path-traversal-to-non-arbitrary-file-deletion-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q5PH-HV6H-Q9VH
Vulnerability from github – Published: 2025-02-12 15:32 – Updated: 2025-02-12 15:32A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
{
"affected": [],
"aliases": [
"CVE-2025-26352"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:35Z",
"severity": "MODERATE"
},
"details": "A CWE-35 \"Path Traversal\" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.",
"id": "GHSA-q5ph-hv6h-q9vh",
"modified": "2025-02-12T15:32:00Z",
"published": "2025-02-12T15:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26352"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26352"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q65P-Q52G-JJGH
Vulnerability from github – Published: 2025-10-14 03:30 – Updated: 2025-10-14 03:30SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availability of the application.
{
"affected": [],
"aliases": [
"CVE-2025-42937"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T01:15:33Z",
"severity": "CRITICAL"
},
"details": "SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availability of the application.",
"id": "GHSA-q65p-q52g-jjgh",
"modified": "2025-10-14T03:30:57Z",
"published": "2025-10-14T03:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42937"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3630595"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q68R-7388-9J79
Vulnerability from github – Published: 2023-06-01 18:30 – Updated: 2024-04-04 04:27In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory.
{
"affected": [],
"aliases": [
"CVE-2023-32714"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-01T17:15:10Z",
"severity": "HIGH"
},
"details": "In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory.",
"id": "GHSA-q68r-7388-9j79",
"modified": "2024-04-04T04:27:57Z",
"published": "2023-06-01T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32714"
},
{
"type": "WEB",
"url": "https://advisory.splunk.com/advisories/SVD-2023-0608"
},
{
"type": "WEB",
"url": "https://research.splunk.com/application/8ed58987-738d-4917-9e44-b8ef6ab948a6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QGJM-8MVC-7R64
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-26 18:31Path Traversal: '.../...//' vulnerability in Snowray Software File Uploader for WooCommerce file-uploader-for-woocommerce allows Path Traversal.This issue affects File Uploader for WooCommerce: from n/a through <= 1.0.4.
{
"affected": [],
"aliases": [
"CVE-2026-25397"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T17:16:49Z",
"severity": "HIGH"
},
"details": "Path Traversal: \u0027.../...//\u0027 vulnerability in Snowray Software File Uploader for WooCommerce file-uploader-for-woocommerce allows Path Traversal.This issue affects File Uploader for WooCommerce: from n/a through \u003c= 1.0.4.",
"id": "GHSA-qgjm-8mvc-7r64",
"modified": "2026-03-26T18:31:33Z",
"published": "2026-03-25T18:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25397"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/file-uploader-for-woocommerce/vulnerability/wordpress-file-uploader-for-woocommerce-plugin-1-0-4-path-traversal-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5.1
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
- Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, the ".../...//" manipulation is useful for bypassing some path traversal protection schemes. If "../" sequences are removed from the ".../...//" string in a sequential fashion (as some regular expression engines and other algorithms operate) the string can collapse into the unsafe "../" value (CWE-182). Removing the first "../" yields "....//" and the second removal yields "../".
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
No CAPEC attack patterns related to this CWE.