CWE-31Variant

Path Traversal: 'dir\..\..\filename'

Draft in the CWE catalog · 1 CVE mapped

1
CVEs mapped
7.7
Median CVSS
What it is

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir\..\..\filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Recent examples
—none
CVE-2026-108120

CVE-2026-108120 - UNKNOWN Severity Vulnerability

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.

no explanation yet
0%
epss
The record
Technical detail
CWE ID
CWE-31
Abstraction
Variant
Structure
Simple
Status
Draft