CWE-30— Path Traversal: '\dir\..\filename'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\dir\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.— MITRE CWE catalog

2 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-30page 1 of 1

• CVE-2025-54386CRITICALCVSS 9.8EG 9.8

  2025-08-02

  Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a malicious…

• CVE-2026-79824HIGHCVSS 8.0EG 8.0

  2026-10-15

  A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.