CWE-23Relative Path Traversal

Abstraction: Base · CVEs in our corpus: 510

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Last updated: 25 September 2026 21:25 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
AC-3 Access Enforcement
AC-4 Information Flow Enforcement
AC-6 Least Privilege

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V5.3.2

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2021-40870` KEV	9.9	9.8	0.9302	2021-09-13
`CVE-2025-64446` KEV	9.9	9.8	0.9184	2025-11-14
`CVE-2023-34990`	8.7	9.8	0.2475	2024-12-18
`CVE-2020-5410` KEV	8.5	7.5	0.9559	2020-06-02
`CVE-2024-27199` KEV	8.3	7.3	0.9999	2024-03-04
`CVE-2020-8271`	8.2	9.8	0.1108	2020-11-16
`CVE-2024-24578`	8.2	10.0	0.0874	2024-03-18
`CVE-2025-55752`	8.1	7.5	0.6653	2025-10-27
`CVE-2020-10619`	7.9	9.1	0.1433	2020-04-09
`CVE-2020-17518`	7.9	7.5	0.5004	2021-01-05
`CVE-2025-34510`	7.9	8.8	0.2430	2025-06-17
`CVE-2012-6069`	7.8	10.0	0.0264	2013-01-21
`CVE-2020-12006`	7.8	9.8	0.0369	2020-05-08
`CVE-2020-27304`	7.8	9.8	0.0324	2021-10-21
`CVE-2022-23854`	7.8	7.5	0.4596	2022-12-23
`CVE-2024-2053`	7.8	7.5	0.4458	2024-03-21
`CVE-2017-9664`	7.7	9.8	0.0262	2018-05-24
`CVE-2019-17640`	7.7	9.8	0.0200	2020-10-15
`CVE-2020-25172`	7.7	9.8	0.0203	2020-11-06
`CVE-2020-5405`	7.6	6.5	0.6876	2020-03-05
`CVE-2020-10631`	7.6	9.8	0.0148	2020-04-09
`CVE-2022-28814`	7.6	9.8	0.0129	2022-09-28
`CVE-2022-39345`	7.6	9.8	0.0141	2022-10-25
`CVE-2023-6825`	7.6	9.9	0.0601	2024-03-13
`CVE-2024-11311`	7.6	9.8	0.0139	2024-11-18