On this page
CWE-73: External Control of File Name or Path
Weakness Summary
The product allows user input to control or influence paths or file names that are used in filesystem operations.
- Canonical source: MITRE CWE-73 (opens in a new tab)
- Published Atomicorp CVE observations: 65
- Distinct affected products in those observations: 59
- Active Atomicorp rules associated with this weakness: 59
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2024-13984 | Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload | TianQing Management Center | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-58192 | Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin | appium/storage-plugin | Protected by Atomicorp rules | 340007 , 344360 |
| CVE-2026-57155 | OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer | core | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-17246 | Kibana - Local File Inclusion | kibana | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-39952 | Fortinet FortiNAC keyUpload.jsp arbitrary file write | fortinac | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2023-3643 | CAREL Boss Mini <= 1.4.0 - Local File Inclusion | boss-mini | Protected by Atomicorp rules | 344360 , 390709 |
| CVE-2023-4634 | Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion | media library assistant | Protected by Atomicorp rules | 300017 |
| CVE-2024-8517 | SPIP BigUp Plugin Unauthenticated RCE | spip | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2025-71334 | Flowise - Path Traversal | flowise | Protected by Atomicorp rules | 340007 |
| CVE-2026-85520 | Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module | Google Merchant Center Feed | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-86189 | WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php | AVideo | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2025-65473 | easyimages2.0 Arbitrary Code Execution Vulnerability | easyimages2.0 | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-48162 | Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file pa | wazuh | Protected by Atomicorp rules | 340007 , 344360 , 350591 , 390709 |
| CVE-2026-50006 | Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in | anyquery | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390501 , 390709 , 390716 , 390904 , 393655 |
| CVE-2026-53581 | ntp: write path traversal | core | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2025-66449 | ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution | convertx | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-60009 | theia Arbitrary Code Execution Vulnerability | theia | Protected by Atomicorp rules | 351000 |
| CVE-2025-71324 | Flowise - Path Traversal | flowise | Protected by Atomicorp rules | 340007 |
| CVE-2026-62865 | TypeBot: Arbitrary server file read via Send Email block attachment path | typebot.io | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2022-24900 | Piano LED Visualizer 1.3 - Local File Inclusion | piano led visualizer | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-35032 | Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner | jellyfin | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-96656 | Plex Media Server - Arbitrary File Write | Media Server | Protected by Atomicorp rules | 398125 |
| CVE-2026-31939 | Path Traversal (Arbitrary File Delete) in Chamilo LMS | chamilo lms | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-111234 | SimplePie through 1.9.0 Local File Read via file:// Redirect | simplepie | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2025-13322 | WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter | WP AUDIO GALLERY | Protected by Atomicorp rules | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-15983 | Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter | Super Forms – Drag & Drop Form Builder | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 , 390904 |
| CVE-2026-34522 | SillyTavern: Path traversal in /api/chats/import allows arbitrary file write outside intended chat directory | sillytavern | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-46402 | Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside | UFO | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-53580 | Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature | trilium | Protected by Atomicorp rules | 340007 , 347009 |
| CVE-2026-64679 | Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation | atlantis | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2024-5334 | Devika - Local File Inclusion | devika | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2025-59049 | Mockoon < 9.2.0 - Path Traversal | mockoon | Protected by Atomicorp rules | 347009 |
| CVE-2026-19913 | Kaltura HTML5 Video Player, html5lib library Improper Input Validation Vulnerability | Kaltura HTML5 Video Player, html5lib library | Protected by Atomicorp rules | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-29962 | HSC MailInspector - Local File Inclusion | mailinspector | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2026-54629 | Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode | anyquery | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-58762 | Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and Script notification agent | tautulli | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-35174 | Chyrp Lite has a Path Traversal to Remote Code Execution | chyrp lite | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-85160 | AVideo through c91b5975d CSRF and Path Traversal via stopLive.php | AVideo | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-45725 | compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal | compliance-trestle | Detected by Atomicorp rules | 347009 |
| CVE-2026-61647 | @roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended va | notebooklm-mcp | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-75830 | grav-plugin-api before 1.0.15 Path Traversal via batchCopy | grav | Protected by Atomicorp rules | 340007 , 344360 |
| CVE-2026-76210 | phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export | phpmyfaq | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-92153 | F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath | fprime | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-9587 | Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal | Switchvox SMB Edition | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54134 | OctoPrint: File exfiltration possible via query parameters on upload endpoints | OctoPrint | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-111230 | Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL | pfsense | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-35593 | Trilium Notes has Local File Inclusion via upload modified file API endpoint | Trilium | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2025-13380 | AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read | AI Engine for WordPress: ChatGPT, GPT Content Generator | Protected by Atomicorp rules | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2025-49138 | HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter | haxcms-php | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-33989 | @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools | mobile mcp | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-46397 | haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 | haxcms-php | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-75602 | OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool | OpenList | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2025-35053 | Newforma Info Exchange (NIX) arbitrary file read and delete | project center | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-79653 | Eclipse SW360 Path Traversal Vulnerability | Eclipse SW360 | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-40605 | Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API | Tautulli | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10694 | SourceCodester Online Food Ordering System index.php include file inclusion | Online Food Ordering System | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2023-30943 | Moodle - Cross-Site Scripting/Remote Code Execution | moodle | Protected by Atomicorp rules | 333141 , 340007 , 340099 , 340147 , 340148 , 340149 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-34967 | Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write | adminer | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-24966 | WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated) | error log viewer | Protected by Atomicorp rules | 336461 , 344360 , 381206 |
| CVE-2026-41412 | alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script | alf.io | Detected by Atomicorp rules | 344360 |
| CVE-2026-10558 | SourceCodester Pizzafy Ecommerce System index.php file inclusion | Pizzafy Ecommerce System | Protected by Atomicorp rules | 344360 , 347009 |
| CVE-2026-10559 | SourceCodester Pizzafy Ecommerce System index.php file inclusion | Pizzafy Ecommerce System | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-15921 | nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory | nvm | Protected by Atomicorp rules | 347009 |
| CVE-2026-19353 | DedeCMS Installation Wizard index.php _4_Setup file inclusion | DedeCMS | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-86147 | Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof | Apache bRPC | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 300017 | Active | disruptive (deny) |
| 330791 | Active | disruptive (deny) |
| 333141 | Active | disruptive (deny) |
| 334168 | Active | disruptive (deny) |
| 336461 | Active | disruptive (deny) |
| 337109 | Active | disruptive (deny) |
| 337110 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340014 | Active | disruptive (deny) |
| 340023 | Active | disruptive (deny) |
| 340029 | Active | disruptive (deny) |
| 340099 | Active | disruptive (deny) |
| 340128 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 340149 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340193 | Active | disruptive (deny) |
| 340748 | Active | disruptive (deny) |
| 341099 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344362 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344364 | Active | disruptive (deny) |
| 344365 | Active | disruptive (deny) |
| 344366 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 344380 | Active | disruptive (deny) |
| 344382 | Active | disruptive (deny) |
| 344385 | Active | disruptive (deny) |
| 346755 | Active | disruptive (deny) |
| 347006 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 347198 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 350591 | Active | disruptive (deny) |
| 351000 | Active | disruptive (deny) |
| 360029 | Active | disruptive (deny) |
| 360152 | Active | disruptive (deny) |
| 380018 | Active | disruptive (deny) |
| 381206 | Active | disruptive (deny) |
| 390501 | Active | disruptive (deny) |
| 390613 | Active | disruptive (deny) |
| 390614 | Active | disruptive (deny) |
| 390700 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390716 | Active | disruptive (deny) |
| 390722 | Active | disruptive (deny) |
| 390801 | Active | disruptive (deny) |
| 390904 | Active | disruptive (deny) |
| 393655 | Active | disruptive (deny) |
| 398008 | Active | non-disruptive (pass) |
| 398021 | Active | disruptive (deny) |
| 398022 | Active | disruptive (deny) |
| 398125 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:
CAPEC-13 (opens in a new tab) , CAPEC-267 (opens in a new tab) , CAPEC-64 (opens in a new tab) , CAPEC-72 (opens in a new tab) , CAPEC-76 (opens in a new tab) , CAPEC-78 (opens in a new tab) , CAPEC-79 (opens in a new tab) , CAPEC-80 (opens in a new tab)