On this page
CWE-23: Relative Path Traversal
Weakness Summary
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
- Canonical source: MITRE CWE-23 (opens in a new tab)
- Published Atomicorp CVE observations: 20
- Distinct affected products in those observations: 19
- Active Atomicorp rules associated with this weakness: 19
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2023-6825 | WordPress File Manager <= 7.2.1 - Directory Traversal | file manager | Detected by Atomicorp rules | 377360 |
| CVE-2021-40870 | Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution | controller | Protected by Atomicorp rules | 340007 |
| CVE-2023-34990 | FortiWLM - Directory Traversal | fortiwlm | Protected by Atomicorp rules | 340007 |
| CVE-2024-24578 | RaspberryMatic unauthenticated Remote Code Execution vulnerability through HMServer File Upload. | raspberrymatic | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 390700 |
| CVE-2025-47445 | WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download | eventin | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2025-64446 | Fortinet FortiWeb unauthenticated RCE | fortiweb | Protected by Atomicorp rules | 340006 , 340007 , 344360 , 344361 , 344363 , 344364 , 344370 , 390709 , 390719 , 390904 |
| CVE-2025-55748 | XWiki Platform - Path Traversal | xwiki | Protected by Atomicorp rules | 340007 |
| CVE-2026-23734 | XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash | xwiki-commons | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-34510 | Sitecore XP CVE-2025-34510 Post-Authentication Remote Code Execution | experience commerce | Protected by Atomicorp rules | 340007 , 344360 , 344364 , 390109 , 390709 , 390724 |
| CVE-2026-85199 | Eclipse aeriOS Path Traversal Vulnerability | Eclipse aeriOS | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-31831 | Tautulli <= 2.16.1 - Path Traversal | tautulli | Atomicorp rules identified for this CVE | 346019 |
| CVE-2025-59835 | LangBot has a cross-directory file upload vulnerability, which could lead to system takeover | LangBot | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-48126 | Algernon: Host header path traversal in –domain mode reads files and runs Lua from parent dir | algernon | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-59341 | esm.sh <= v136 - Local File Inclusion | esm.sh | Protected by Atomicorp rules | 347009 |
| CVE-2026-54910 | FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files | filebrowser | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-5410 | Spring Cloud Config Server - Local File Inclusion | spring cloud config | Protected by Atomicorp rules | 390709 |
| CVE-2022-23854 | AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion | intouch access anywhere | Protected by Atomicorp rules | 390716 |
| CVE-2023-2356 | Mlflow <2.3.0 - Local File Inclusion | mlflow | Protected by Atomicorp rules | 340007 |
| CVE-2022-1373 | Softing Secure Integration Server v1.22 Remote Code Execution | edgeaggregator | Protected by Atomicorp rules | 340006 , 340007 , 344360 , 347009 , 390709 |
| CVE-2020-5405 | Spring Cloud Config - Local File Inclusion | spring cloud config | Protected by Atomicorp rules | 390709 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 330791 | Active | disruptive (deny) |
| 334168 | Active | disruptive (deny) |
| 340006 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344364 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 346019 | Retired | non-disruptive (not available) |
| 347009 | Active | disruptive (deny) |
| 377360 | Active | non-disruptive (pass) |
| 390109 | Active | disruptive (deny) |
| 390700 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390716 | Active | disruptive (deny) |
| 390719 | Active | disruptive (deny) |
| 390724 | Active | disruptive (deny) |
| 390904 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:
CAPEC-139 (opens in a new tab) , CAPEC-76 (opens in a new tab)