On this page
Atomicorp WAF Rule 340006
Rule Summary
- Rule ID: 340006
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Generic Path Recursion denied in URI/headers
- Observed CWEs: CWE-20 (8), CWE-22 (45), CWE-23 (2), CWE-26 (1), CWE-27 (2), CWE-31 (1), CWE-36 (1), CWE-74 (1), CWE-77 (1), CWE-78 (2), CWE-88 (1), CWE-89 (7), CWE-94 (2), CWE-98 (2), CWE-121 (2), CWE-177 (1), CWE-200 (2), CWE-259 (1), CWE-269 (2), CWE-284 (1), CWE-287 (5), CWE-288 (1), CWE-306 (3), CWE-361 (1), CWE-427 (1), CWE-434 (12), CWE-444 (1), CWE-502 (1), CWE-706 (1), CWE-787 (2), CWE-798 (2), CWE-1336 (1)
- Revision: 70
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request filename, Request headers
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule is detecting the use of path recursion in an Argument, Header or in the URI. An example of a recursion is:
../..
An example attack could be to get to a protected file on the system. For example:
../../../../../etc/passwd
False Positives
Some applications may use recursions to access some files. Therefore a false positive can occur. It is not recommended that you disable this rule without ensuring that this is both normal and safe for your application. For example, if your application allows directory recursions, but does not limit recursion this may make it possible for an attacker to access any file on your system.
If you believe this is both safe, and a false positive, please report this to our security team. We can determine if this is a legitimate case, or if its clever attack on your system and if a modification to the rules is advised to allow this activity. Instructions to report false positives are detailed on the Reporting False Positives wiki page.
If you wish to tune this rule yourself, please see the Tuning the Atomicorp WAF Rules page for basic information.
Similar Rules
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2011-2653 | Novell ZENworks Asset Management Remote Execution | zenworks asset management | 10.0 (v2.0) | High |
| CVE-2011-3167 | HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow | openview network node manager | 10.0 (v2.0) | High |
| CVE-2012-3811 | Avaya IP Office Customer Call Reporter ImageUpload.ashx Remote Command Execution | ip office customer call reporter | 10.0 (v2.0) | High |
| CVE-2013-1080 | Novell ZENworks Configuration Management Remote Execution | zenworks configuration management | 10.0 (v2.0) | High |
| CVE-2013-4811 | HP ProCurve Manager SNAC UpdateDomainControllerServlet File Upload | identity driven manager | 10.0 (v2.0) | High |
| CVE-2013-4812 | HP ProCurve Manager SNAC UpdateCertificatesServlet File Upload | identity driven manager | 10.0 (v2.0) | High |
| CVE-2013-6221 | HP AutoPass License Server File Upload | service virtualization | 10.0 (v2.0) | High |
| CVE-2024-1709 | ConnectWise ScreenConnect Unauthenticated Remote Code Execution | screenconnect | 10.0 (v3.1) | Critical |
| CVE-2024-3400 | Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution | pan-os | 10.0 (v3.1) | Critical |
| CVE-2024-4040 | CrushFTP Unauthenticated Arbitrary File Read | crushftp | 10.0 (v3.1) | Critical |
| CVE-2025-52691 | SmarterTools SmarterMail GUID File Upload Vulnerability | smartermail | 10.0 (v3.1) | Critical |
| CVE-2024-2044 | pgAdmin Session Deserialization RCE | pgadmin 4 | 9.9 (v3.1) | Critical |
| CVE-2025-24016 | Wazuh server remote code execution caused by an unsafe deserialization vulnerability. | wazuh | 9.9 (v3.1) | Critical |
| CVE-2014-8741 | Lexmark MarkVision Enterprise Arbitrary File Upload | markvision enterprise | 9.8 (v3.1) | Critical |
| CVE-2016-2555 | ATutor 2.2.1 SQL Injection / Remote Code Execution | atutor | 9.8 (v3.0) | Critical |
| CVE-2016-7547 | Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution | threat discovery appliance | 9.8 (v3.0) | Critical |
| CVE-2016-7552 | Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution | threat discovery appliance | 9.8 (v3.0) | Critical |
| CVE-2017-1000002 | ATutor 2.2.1 Directory Traversal / Remote Code Execution | atutor | 9.8 (v3.0) | Critical |
| CVE-2018-17552 | Navigate CMS Unauthenticated Remote Code Execution | navigate cms | 9.8 (v3.0) | Critical |
| CVE-2019-1821 | Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability | evolved programmable network manager | 9.8 (v3.0) | Critical |
| CVE-2019-19781 | Citrix ADC (NetScaler) Directory Traversal RCE | application delivery controller firmware | 9.8 (v3.1) | Critical |
| CVE-2019-9194 | elFinder PHP Connector exiftran Command Injection | elfinder | 9.8 (v3.0) | Critical |
| CVE-2020-3243 | Cisco UCS Director Cloupia Script RCE | ucs director | 9.8 (v3.1) | Critical |
| CVE-2020-3250 | Cisco UCS Director Cloupia Script RCE | ucs director | 9.8 (v3.1) | Critical |
| CVE-2020-4427 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-4429 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2021-21972 | VMware vCenter Server Unauthenticated OVA File Upload RCE | cloud foundation | 9.8 (v3.1) | Critical |
| CVE-2021-3378 | FortiLogger Arbitrary File Upload Exploit | fortilogger | 9.8 (v3.1) | Critical |
| CVE-2021-40539 | ManageEngine ADSelfService Plus CVE-2021-40539 | manageengine adselfservice plus | 9.8 (v3.1) | Critical |
| CVE-2021-45837 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | 9.8 (v3.1) | Critical |
| CVE-2022-20705 | Cisco RV Series Authentication Bypass and Command Injection | rv340 firmware | 9.8 (v3.1) | Critical |
| CVE-2022-24989 | TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989 | terramaster operating system | 9.8 (v3.1) | Critical |
| CVE-2023-26469 | Jorani unauthenticated Remote Code Execution | jorani | 9.8 (v3.1) | Critical |
| CVE-2023-40498 | LG Simple Editor Remote Code Execution | simple editor | 9.8 (v3.1) | Critical |
| CVE-2024-23897 | Jenkins cli Ampersand Replacement Arbitrary File Read | jenkins | 9.8 (v3.1) | Critical |
| CVE-2025-64446 | Fortinet FortiWeb unauthenticated RCE | fortiweb | 9.8 (v3.1) | Critical |
| CVE-2024-31214 | Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809) | traccar | 9.6 (v3.1) | Critical |
| CVE-2026-85185 | Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root | LXD | 9.6 (v3.1) | Critical |
| CVE-2013-10047 | MiniWeb (Build 300) Arbitrary File Upload | MiniWeb | 9.3 (v4.0) | Critical |
| CVE-2025-34100 | BuilderEngine Arbitrary File Upload Vulnerability and execution | CMS | 9.3 (v4.0) | Critical |
| CVE-2025-34111 | Tiki Wiki Unauthenticated File Upload Vulnerability | tikiwiki cms/groupware | 9.3 (v4.0) | Critical |
| CVE-2025-66039 | FreePBX firmware file upload | freepbx | 9.3 (v4.0) | Critical |
| CVE-2026-24479 | HUSTOJ Admin users can zip-slip problem_import_qduoj.php, planting PHP files in webroot for RCE | hustoj | 9.3 (v4.0) | Critical |
| CVE-2026-15896 | Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter | Super Forms – Drag & Drop Form Builder | 9.1 (v3.1) | Critical |
| CVE-2018-17553 | Navigate CMS Unauthenticated Remote Code Execution | navigate cms | 8.8 (v3.0) | High |
| CVE-2019-12169 | ATutor 2.2.4 - Directory Traversal / Remote Code Execution, | atutor | 8.8 (v3.1) | High |
| CVE-2019-16113 | Bludit Directory Traversal Image File Upload Vulnerability | bludit | 8.8 (v3.1) | High |
| CVE-2019-8942 | WordPress Crop-image Shell Upload | WordPress | 8.8 (v3.0) | High |
| CVE-2019-9858 | Horde Form File Upload Vulnerability | groupware | 8.8 (v3.1) | High |
| CVE-2020-7246 | qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE) | qdpm | 8.8 (v3.1) | High |
| CVE-2022-34876 | VICIdial Multiple Authenticated SQLi | vicidial | 8.8 (v3.1) | High |
| CVE-2022-34877 | VICIdial Multiple Authenticated SQLi | vicidial | 8.8 (v3.1) | High |
| CVE-2022-34878 | VICIdial Multiple Authenticated SQLi | vicidial | 8.8 (v3.1) | High |
| CVE-2023-49084 | Cacti RCE via SQLi in pollers.php | cacti | 8.8 (v3.1) | High |
| CVE-2023-49085 | Cacti RCE via SQLi in pollers.php | cacti | 8.8 (v3.1) | High |
| CVE-2010-10012 | Httpdasm Directory Traversal | httpdasm | 8.7 (v4.0) | High |
| CVE-2012-10034 | ClanSphere 2011.3 Local File Inclusion Vulnerability | clansphere | 8.7 (v4.0) | High |
| CVE-2025-57790 | Commvault Command-Line Argument Injection to Traversal Remote Code Execution | commvault | 8.7 (v4.0) | High |
| CVE-2025-61678 | FreePBX firmware file upload | endpointman | 8.6 (v4.0) | High |
| CVE-2013-0136 | Mutiny 5 Arbitrary File Upload | mutiny | 8.5 (v2.0) | High |
| CVE-2024-24809 | Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809) | traccar | 8.5 (v3.1) | High |
| CVE-2024-1708 | ConnectWise ScreenConnect Unauthenticated Remote Code Execution | screenconnect | 8.4 (v3.1) | High |
| CVE-2025-30005 | Xorcom CompletePBX Arbitrary File Read and Deletion via systemDataFileName | completepbx | 8.3 (v3.1) | High |
| CVE-2021-45841 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | 8.1 (v3.1) | High |
| CVE-2026-104995 | BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'aja | BP Profile Search | 8.1 (v3.1) | High |
| CVE-2011-4166 | HP Managed Printing Administration jobAcct Remote Command Execution | managed printing administration | 7.5 (v2.0) | High |
| CVE-2013-1081 | Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability | zenworks mobile management | 7.5 (v2.0) | High |
| CVE-2013-5639 | Gnew 2013.1 - Multiple Vulnerabilities (2) | gnew | 7.5 (v2.0) | High |
| CVE-2013-5640 | Gnew 2013.1 - Multiple Vulnerabilities (2) | gnew | 7.5 (v2.0) | High |
| CVE-2014-7863 | ManageEngine Multiple Products Arbitrary File Download | manageengine applications manager | 7.5 (v3.1) | High |
| CVE-2019-5418 | Ruby on Rails Path Traversal and Arbitrary File Read (CVE-2019-5418) | rails | 7.5 (v3.1) | High |
| CVE-2022-24990 | TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989 | terramaster operating system | 7.5 (v3.1) | High |
| CVE-2023-2825 | GitLab Authenticated File Read | gitlab | 7.5 (v3.1) | High |
| CVE-2023-32315 | Openfire authentication bypass with RCE plugin | openfire | 7.5 (v3.1) | High |
| CVE-2024-28995 | SolarWinds Serv-U Unauthenticated Arbitrary File Read | serv-u | 7.5 (v3.1) | High |
| CVE-2024-20767 | CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read | coldfusion | 7.4 (v3.1) | High |
| CVE-2022-20707 | Cisco RV Series Authentication Bypass and Command Injection | rv340 firmware | 7.3 (v3.1) | High |
| CVE-2020-8260 | Pulse Secure VPN gzip RCE | connect secure | 7.2 (v3.1) | High |
| CVE-2022-1373 | Softing Secure Integration Server v1.22 Remote Code Execution | edgeaggregator | 7.2 (v3.1) | High |
| CVE-2022-2334 | Softing Secure Integration Server v1.22 Remote Code Execution | edgeaggregator | 7.2 (v3.1) | High |
| CVE-2025-58034 | Fortinet FortiWeb unauthenticated RCE | fortiweb | 7.2 (v3.1) | High |
| CVE-2025-57788 | Commvault Command-Line Argument Injection to Traversal Remote Code Execution | commvault | 6.9 (v4.0) | Medium |
| CVE-2025-57791 | Commvault Command-Line Argument Injection to Traversal Remote Code Execution | commvault | 6.9 (v4.0) | Medium |
| CVE-2026-116800 | WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header | AVideo | 6.9 (v4.0) | Medium |
| CVE-2011-4350 | Yaws Web Server Directory Traversal | yaws | 6.5 (v3.1) | Medium |
| CVE-2015-2994 | SysAid Help Desk Administrator Portal Arbitrary File Upload | sysaid | 6.5 (v2.0) | Medium |
| CVE-2016-6435 | Cisco Firepower Management Console 6.0 Post Auth Report Download Directory Traversal | secure firewall management center | 6.5 (v3.0) | Medium |
| CVE-2019-8943 | WordPress Crop-image Shell Upload | WordPress | 6.5 (v3.1) | Medium |
| CVE-2021-45839 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | 6.5 (v3.1) | Medium |
| CVE-2025-2292 | Xorcom CompletePBX Authenticated File Disclosure via Backup Download | completepbx | 6.5 (v3.1) | Medium |
| CVE-2012-4940 | Axigen Arbitrary File Read and Delete | axigen free mail server | 6.4 (v2.0) | Medium |
| CVE-2019-2557 | Oracle Application Testing Suite Post-Auth DownloadServlet Directory Traversal | application testing suite | 6.3 (v3.0) | Medium |
| CVE-2014-8727 | F5 BIG-IP 10.1.0 - Directory Traversal | big-ip local traffic manager | 6.2 (v2.0) | Medium |
| CVE-2012-6081 | MoinMoin twikidraw Action Traversal File Upload | moinmoin | 6.0 (v2.0) | Medium |
| CVE-2013-3631 | NAS4Free Arbitrary Remote Code Execution | nas4free | 6.0 (v2.0) | Medium |
| CVE-2020-10977 | GitLab File Read Remote Code Execution | gitlab | 5.5 (v3.1) | Medium |
| CVE-2026-115877 | Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value | twisted | 5.4 (v3.1) | Medium |
| CVE-2018-16133 | Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal | cybrohttpserver | 5.3 (v3.0) | Medium |
| CVE-2012-2983 | Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access | webmin | 5.0 (v2.0) | Medium |
| CVE-2012-4031 | WANGKONGBAO CNS-1000 and 1100 UTM Directory Traversal | cns-1000 | 5.0 (v2.0) | Medium |
| CVE-2012-4347 | Symantec Messaging Gateway 9.5 Log File Download Vulnerability | messaging gateway | 5.0 (v2.0) | Medium |
| CVE-2013-7091 | Zimbra Collaboration Server LFI | zimbra collaboration suite | 5.0 (v2.0) | Medium |
| CVE-2015-1830 | Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload | activemq | 5.0 (v2.0) | Medium |
| CVE-2013-6785 | Supermicro Onboard IPMI url_redirect.cgi Authenticated Directory Traversal | intelligent platform management interface | 4.3 (v3.1) | Medium |
| CVE-2026-86334 | CLI Path Traversal via Content-Disposition in LXD Image Export/Copy | LXD | 4.2 (v3.1) | Medium |
| CVE-2014-2424 | Oracle Event Processing FileUploadServlet Arbitrary File Upload | fusion middleware | 4.0 (v2.0) | Medium |
| CVE-2025-11990 | Improper Handling of URL Encoding (Hex Encoding) in GitLab | gitlab | 3.5 (v3.1) | Low |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.
Documentation Source
- Original wiki page: WAF 340006
- Source revision: 3136
- Source revision date: 2013-02-03