Home/CWE/Relative Path Traversal
Weakness

Relative Path Traversal

CWE-23 · Base · Draft

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Children (more specific)
ParentOfCWE-24 · Path Traversal: '../filedir'
ParentOfCWE-25 · Path Traversal: '/../filedir'
ParentOfCWE-26 · Path Traversal: '/dir/../filename'
ParentOfCWE-27 · Path Traversal: 'dir/../../filename'
ParentOfCWE-28 · Path Traversal: '..\filedir'
ParentOfCWE-29 · Path Traversal: '\..\filename'
ParentOfCWE-30 · Path Traversal: '\dir\..\filename'
ParentOfCWE-31 · Path Traversal: 'dir\..\..\filename'
ParentOfCWE-32 · Path Traversal: '...' (Triple Dot)
ParentOfCWE-33 · Path Traversal: '....' (Multiple Dot)
ParentOfCWE-34 · Path Traversal: '....//'
ParentOfCWE-35 · Path Traversal: '.../...//'
◆

Attack Patterns (CAPEC)

2
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-139Relative Path Traversal
CAPEC-76Manipulating Web Input to File System Calls
⚠

CVEs With This Weakness

401
A sample of the 401 CVEs tagged with this weakness.
CVECVE-2026-8209
CVECVE-2026-7404
CVECVE-2026-5966
CVECVE-2026-4415
CVECVE-2026-43616
CVECVE-2026-43533
CVECVE-2026-42085
CVECVE-2026-41948
CVECVE-2026-41612
CVECVE-2026-41551
CVECVE-2026-39814
CVECVE-2026-33733
◉

Nuclei Scanner Templates

30
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalOffice Anywhere TongDa - Path Traversal
criticalMikoPBX - Unrestricted File Upload
criticalFortiWeb - Authentication Bypass
criticalAviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution
criticalSitecore - Remote Code Execution
criticalFortiWLM - Directory Traversal
highThinkCMF - Local File Inclusion
highIBM InfoPrint 4247-Z03 Impact Matrix Printer - Local File Inclusion
highWindows - Local File Inclusion
highGeneric J2EE LFI Scan Panel - Detect
highGeneric Linux - Local File Inclusion
highJoomla! Component Easy Shop 1.2.3 - Local File Inclusion
highJoomla! Component com_sef - Local File Inclusion
highAccent Microcomputers LFI
highACTi-Video Monitoring - Local File Inclusion
highAVCON6 org_execl_download.action - Arbitrary File Download
highCPAS Management System - Arbitrary File Read
high3CX Management Console - Local File Inclusion
highC-Lodop Printer - Arbitrary File Read
highAlibaba Anyproxy fetchBody File - Path Traversal
highBlue Ocean Excellence - Local File Inclusion
highCrawlab - Arbitrary File Read
highAVCON6 - Arbitrary File Download
highLongjing Technology BEMS API 1.21 - Local File Inclusion
highBullwark Momentum Series JAWS 1.0 - Local File Inclusion
highArray VPN - Arbitrary File Reading Vulnerability
highCrystal Live HTTP Server 6.01 - Local File Inclusion
highAsanhamayesh CMS 3.4.6 - Local File Inclusion
highOA E-Office officeserver.php Arbitrary File Read
highEcology Springframework - Local File Inclusion
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin