On this page
CWE-23: Relative Path Traversal
Weakness Summary
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
- Canonical source: MITRE CWE-23 (opens in a new tab)
- Published Atomicorp CVE observations: 15
- Distinct affected products in those observations: 14
- Active Atomicorp rules associated with this weakness: 6
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2023-6825 | WordPress File Manager <= 7.2.1 - Directory Traversal | file manager | Detected by Atomicorp | 377360 |
| CVE-2021-40870 | Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution | controller | Attack Blocked by Atomicorp | 340007 |
| CVE-2023-34990 | FortiWLM - Directory Traversal | fortiwlm | Attack Blocked by Atomicorp | 340007 |
| CVE-2025-47445 | WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download | eventin | Attack Blocked by Atomicorp | 344360 , 347009 , 390709 |
| CVE-2025-55748 | XWiki Platform - Path Traversal | xwiki | Attack Blocked by Atomicorp | 340007 |
| CVE-2026-23734 | XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash | xwiki-commons | Attack Blocked by Atomicorp | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-85199 | Eclipse aeriOS Path Traversal Vulnerability | Eclipse aeriOS | Attack Blocked by Atomicorp | 340007 , 344360 , 390709 |
| CVE-2026-31831 | Tautulli <= 2.16.1 - Path Traversal | tautulli | Attack Blocked by Atomicorp | 346019 |
| CVE-2026-48126 | Algernon: Host header path traversal in –domain mode reads files and runs Lua from parent dir | algernon | Attack Blocked by Atomicorp | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-59341 | esm.sh <= v136 - Local File Inclusion | esm.sh | Attack Blocked by Atomicorp | 347009 |
| CVE-2026-54910 | FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files | filebrowser | Attack Blocked by Atomicorp | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-5410 | Spring Cloud Config Server - Local File Inclusion | spring cloud config | Attack Blocked by Atomicorp | 390709 |
| CVE-2022-23854 | AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion | intouch access anywhere | Attack Blocked by Atomicorp | 390716 |
| CVE-2023-2356 | Mlflow <2.3.0 - Local File Inclusion | mlflow | Attack Blocked by Atomicorp | 340007 |
| CVE-2020-5405 | Spring Cloud Config - Local File Inclusion | spring cloud config | Attack Blocked by Atomicorp | 390709 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 340007 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 346019 | Retired | non-disruptive (not available) |
| 347009 | Active | disruptive (deny) |
| 377360 | Active | non-disruptive (pass) |
| 390709 | Active | disruptive (deny) |
| 390716 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:
CAPEC-139 (opens in a new tab) , CAPEC-76 (opens in a new tab)