CWE-25Path Traversal: '/../filedir'

Abstraction: Variant · CVEs in our corpus: 12

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory. Sometimes a program checks for "../" at the beginning of the input, so a "/../" can bypass that check.

Last updated: 21 August 2026 14:15 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
AC-3 Access Enforcement
SI-10 Information Input Validation
AC-4 Information Flow Enforcement

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2022-20775` KEV	8.5	7.8	0.1247	2022-09-30
`CVE-2025-68916`	6.8	9.1	0.0256	2025-12-24
`CVE-2023-52076`	6.2	8.5	0.0102	2024-01-25
`CVE-2023-52138`	6.2	8.2	0.0165	2024-02-05
`CVE-2023-6118`	6.0	7.5	0.0076	2023-11-23
`CVE-2024-2442`	6.0	7.5	0.0070	2024-03-19
`CVE-2022-20818`	5.9	7.8	0.0060	2022-09-30
`CVE-2023-6919`	5.9	7.5	0.0059	2024-01-26
`CVE-2023-6947`	5.8	7.7	0.0075	2024-12-10
`CVE-2026-23877`	3.8	4.3	0.0052	2026-01-19
`CVE-2025-0225`	3.7	4.3	0.0047	2025-01-05
`CVE-2025-58286`	2.7	3.3	0.0010	2025-10-11