CWE-22Base46 in KEV

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Stable in the CWE catalog · 4,759 CVEs mapped

4,759
CVEs mapped
46
In KEV
7.2
Median CVSS
What it is

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Recent examples
5.9cvss
CVE-2026-86258

nbviewer through 1.0.1 Path Traversal via LocalFileHandler

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.

MEDIUMno explanation yet
epss
5.9cvss
CVE-2026-86253

h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.

MEDIUMno explanation yet
epss
5.9cvss
CVE-2026-86251

h3 before 1.15.9 Path Traversal via Double Decoding

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.

MEDIUMno explanation yet
epss
The record
Technical detail
CWE ID
CWE-22
Abstraction
Base
Structure
Simple
Status
Stable
References (10)