CWE-21
Grouping ProhibitedDEPRECATED: Pathname Traversal and Equivalence Errors
Status: Deprecated
This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).
Grouping entries organize the catalogue and should not be used to map the root cause of a vulnerability.
Mapping guidance
This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
See the summary, which might have suggestions for other CWEs to consider.
Content history
updated Relationships, Taxonomy_Mappings, Type
updated Description
updated Related_Attack_Patterns
updated Potential_Mitigations
updated Potential_Mitigations
updated Relationships
updated Applicable_Platforms, Description, Potential_Mitigations, Related_Attack_Patterns, Relationships
updated Relationships
updated Description, Name, Relationships, Type
updated Taxonomy_Mappings
updated Mapping_Notes
updated Mapping_Notes
3 vulnerabilities reference this CWE, most recent first.
CVE-2024-7738 (GCVE-0-2024-7738)
Vulnerability from cvelistv5 – Published: 2024-08-13 19:00 – Updated: 2024-08-13 19:39- CWE-21 - Pathname Traversal
| URL | Tags |
|---|---|
| https://vuldb.com/?id.274358 | vdb-entry |
| https://vuldb.com/?ctiid.274358 | signaturepermissions-required |
| https://vuldb.com/?submit.385634 | third-party-advisory |
| https://github.com/abhi-ingle/Vulnerability-Resea… | exploit |
| https://github.com/abhi-ingle/Vulnerability-Resea… | exploit |
| Vendor | Product | Version | |
|---|---|---|---|
| yzane | vscode-markdown-pdf |
Affected:
1.5.0
|
|
| yzane | vscode_markdown_pdf |
Affected:
1.5.0
cpe:2.3:a:yzane:vscode_markdown_pdf:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:yzane:vscode_markdown_pdf:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vscode_markdown_pdf",
"vendor": "yzane",
"versions": [
{
"status": "affected",
"version": "1.5.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7738",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-13T19:34:01.962181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T19:39:18.425Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Markdown File Handler"
],
"product": "vscode-markdown-pdf",
"vendor": "yzane",
"versions": [
{
"status": "affected",
"version": "1.5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "abhi-ingle (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation leads to pathname traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in yzane vscode-markdown-pdf 1.5.0 entdeckt. Betroffen davon ist ein unbekannter Prozess der Komponente Markdown File Handler. Durch das Manipulieren mit unbekannten Daten kann eine pathname traversal-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-21",
"description": "CWE-21 Pathname Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T19:00:08.048Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-274358 | yzane vscode-markdown-pdf Markdown File pathname traversal",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.274358"
},
{
"name": "VDB-274358 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.274358"
},
{
"name": "Submit #385634 | yzane Markdown PDF Vscode Extension 1.5.0 Pathname Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.385634"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Arbitrary%20File%20Read/file_read_report.md"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Arbitrary%20File%20Read/poc_arbitrary_file_read.mp4"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-08-13T16:08:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "yzane vscode-markdown-pdf Markdown File pathname traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-7738",
"datePublished": "2024-08-13T19:00:08.048Z",
"dateReserved": "2024-08-13T14:03:20.281Z",
"dateUpdated": "2024-08-13T19:39:18.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-15017 (GCVE-0-2016-15017)
Vulnerability from cvelistv5 – Published: 2023-01-10 14:04 – Updated: 2024-08-06 03:47- CWE-21 - Pathname Traversal
| URL | Tags |
|---|---|
| https://vuldb.com/?id.217786 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.217786 | signaturepermissions-required |
| https://github.com/fabarea/media_upload/issues/6 | issue-tracking |
| https://github.com/fabarea/media_upload/commit/b2… | patch |
| https://github.com/fabarea/media_upload/releases/… | patch |
| Vendor | Product | Version | |
|---|---|---|---|
| fabarea | media_upload |
Affected:
n/a
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T03:47:34.829Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.217786"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.217786"
},
{
"tags": [
"issue-tracking",
"x_transferred"
],
"url": "https://github.com/fabarea/media_upload/issues/6"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/fabarea/media_upload/commit/b25d42a4981072321c1a363311d8ea2a4ac8763a"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/fabarea/media_upload/releases/tag/0.9.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "media_upload",
"vendor": "fabarea",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability."
},
{
"lang": "de",
"value": "In fabarea media_upload f\u00fcr TYPO3 wurde eine kritische Schwachstelle gefunden. Das betrifft die Funktion getUploadedFileList der Datei Classes/Service/UploadFileService.php. Durch Manipulieren mit unbekannten Daten kann eine pathname traversal-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 0.9.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als b25d42a4981072321c1a363311d8ea2a4ac8763a bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.2,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-21",
"description": "CWE-21 Pathname Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T10:03:34.971Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.217786"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.217786"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/fabarea/media_upload/issues/6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/fabarea/media_upload/commit/b25d42a4981072321c1a363311d8ea2a4ac8763a"
},
{
"tags": [
"patch"
],
"url": "https://github.com/fabarea/media_upload/releases/tag/0.9.0"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-01-10T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-01-10T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-01-10T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-01-31T08:44:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "fabarea media_upload UploadFileService.php getUploadedFileList pathname traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2016-15017",
"datePublished": "2023-01-10T14:04:49.684Z",
"dateReserved": "2023-01-10T13:59:44.578Z",
"dateUpdated": "2024-08-06T03:47:34.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-10030 (GCVE-0-2015-10030)
Vulnerability from cvelistv5 – Published: 2023-01-08 09:27 – Updated: 2025-04-09 14:42- CWE-21 - Pathname Traversal
| URL | Tags |
|---|---|
| https://vuldb.com/?id.217642 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.217642 | signaturepermissions-required |
| https://github.com/SUKOHI/Surpass/commit/d22337d4… | patch |
| https://github.com/SUKOHI/Surpass/releases/tag/1.0.0 | patch |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:58:25.537Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.217642"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.217642"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/SUKOHI/Surpass/commit/d22337d453a2a14194cdb02bf12cdf9d9f827aa7"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/SUKOHI/Surpass/releases/tag/1.0.0"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2015-10030",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-09T14:41:47.587251Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-09T14:42:24.082Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Surpass",
"vendor": "SUKOHI",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php. The manipulation of the argument dir leads to pathname traversal. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as d22337d453a2a14194cdb02bf12cdf9d9f827aa7. It is recommended to upgrade the affected component. VDB-217642 is the identifier assigned to this vulnerability."
},
{
"lang": "de",
"value": "In SUKOHI Surpass wurde eine kritische Schwachstelle gefunden. Betroffen ist eine unbekannte Verarbeitung der Datei src/Sukohi/Surpass/Surpass.php. Durch das Manipulieren des Arguments dir mit unbekannten Daten kann eine pathname traversal-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 1.0.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als d22337d453a2a14194cdb02bf12cdf9d9f827aa7 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.2,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-21",
"description": "CWE-21 Pathname Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T07:55:24.511Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.217642"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.217642"
},
{
"tags": [
"patch"
],
"url": "https://github.com/SUKOHI/Surpass/commit/d22337d453a2a14194cdb02bf12cdf9d9f827aa7"
},
{
"tags": [
"patch"
],
"url": "https://github.com/SUKOHI/Surpass/releases/tag/1.0.0"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-01-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-01-08T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-01-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-01-30T08:42:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "SUKOHI Surpass Surpass.php pathname traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2015-10030",
"datePublished": "2023-01-08T09:27:12.135Z",
"dateReserved": "2023-01-08T09:26:00.394Z",
"dateUpdated": "2025-04-09T14:42:24.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.