CWE-30Variant

Path Traversal: '\dir\..\filename'

Draft in the CWE catalog · 1 CVE mapped

1
CVEs mapped
7.3
Median CVSS
What it is

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\dir\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Recent examples
7.3cvss
CVE-2025-54386

Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution

⚡ A sneaky path traversal vulnerability in Traefik could let an attacker overwrite any file they choose! 🛠️ Think of it like a delivery driver who misreads an address and ends up dropping packages in the wrong location—this exploit allows a malicious actor to manipulate file paths and deliver their own dangerous files straight to your system. An attacker could potentially gain full remote code execution, escalate privileges, or even cause denial of service, making this a high-stakes game! They could overwrite critical files, leading to chaos on your server. Imagine the disruption if your website goes down or worse!

HIGH
1%
epss
The record
Technical detail
CWE ID
CWE-30
Abstraction
Variant
Structure
Simple
Status
Draft