CVE-2026-14198: Interpretation Conflict

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

CVE-2026-44373: Improper Limitation of a Pathname to a Restricted Directory

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal ..%2f in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in...

CVE-2026-32004: Authentication Bypass Using an Alternate Path or Channel

OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin route authentication checks by submitti...

CVE-2025-10355: URL Redirection to Untrusted Site

Open redirection vulnerability in MOLGENIS EMX2 v11.14.0. This vulnerability allows an attacker to create a malicious URL using a manipulated redirection parameter, potentially leading users to phishing sites or other malicious destinations via “/%2f%2f ”...

CVE-2022-35920: Improper Limitation of a Pathname to a Restricted Directory

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue...

CVE-2022-28380: Improper Limitation of a Pathname to a Restricted Directory

The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...

CVE-2021-43795: Improper Limitation of a Pathname to a Restricted Directory

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains %2F encoded /, such as /files/..%2Fsecrets.txt, bypassing Armeria's path validation...

CVE-2021-3223: Improper Limitation of a Pathname to a Restricted Directory

Node-RED-Dashboard before 2.26.2 allows uibase/js/..%2f directory traversal to read files...

CVE-2020-12447: Improper Limitation of a Pathname to a Restricted Directory

A Local File Inclusion LFI issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow...

CVE-2019-17224: Improper Limitation of a Pathname to a Restricted Directory

The web interface of the Compal Broadband CH7465LG modem version CH7465LG-NCIP-6.12.18.25-2p6-NOSH is vulnerable to a /%2f/ path traversal attack, which can be exploited in order to test for the existence of a file pathname outside of the web root directory. If a file exists but is not part of th...

CVE-2016-10977: Improper Limitation of a Pathname to a Restricted Directory

The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal...

CVE-2018-16287: Unrestricted Upload of File with Dangerous Type

LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs...

CVE-2018-16288: Exposure of Sensitive Information to an Unauthorized Actor

LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs...

PT-2018-13465

Name of the Vulnerable Software and Affected Versions LG SuperSign CMS affected versions not specified Description The issue concerns a file upload vulnerability. It allows file upload via /signEzUI/playlist/edit/upload/..%2f URIs. Recommendations At the moment, there is no information about a...

Path traversal

serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e . and %2f / and allowing them in paths, which allows a malicious user to view the contents of any directory with known path...

CVE-2016-6273: Undefined Security Weakness

The lmadmin component in Flexera FlexNet Publisher aka Flex License Manager before 2015 SP5 and 2016 before R1 SP1, as used by Citrix License Server for Windows before 11.14.0.1 and Citrix License Server VPX before 11.14.0.1, allows remote attackers to cause a denial of service crash via a type 2...

CVE-2014-0353

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00BFQ.6C0 allows remote attackers to bypass authentication by using %2F sequences in place of / slash characters...

CVE-2014-0353

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00BFQ.6C0 allows remote attackers to bypass authentication by using %2F sequences in place of / slash characters...

CVE-2014-0353: Improper Authentication

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00BFQ.6C0 allows remote attackers to bypass authentication by using %2F sequences in place of / slash characters...

CVE-2013-3921: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Easytime Studio Easy File Manager 1.1 for iOS allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash to the default URI...