Cyber Resilience

CWE · MITRE source

CWE-25Path Traversal: '/../filedir'

Abstraction: Variant · CVEs in our corpus: 12

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory. Sometimes a program checks for "../" at the beginning of the input, so a "/../" can bypass that check.

Last updated: 04 July 2026 11:13 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 1 mapping(s) from 1 framework(s): ATT&CK 1 (mostly)

See the full cumulative-coverage rollup →

NIST 800-53 r5 controls that address this weakness (0)AI

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: other covers this; this covers other (F/M/P = full / mostly / partial).

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-20775 KEV10.07.80.12472022-09-30
CVE-2025-689167.09.10.02252025-12-24
CVE-2022-208185.57.80.00592022-09-30
CVE-2023-61185.57.50.00762023-11-23
CVE-2023-520765.58.50.01022024-01-25
CVE-2023-69195.57.50.00582024-01-26
CVE-2023-521385.58.20.01652024-02-05
CVE-2024-2442 UPD5.57.50.00702024-03-19
CVE-2023-69475.57.70.00732024-12-10
CVE-2025-02253.54.30.00462025-01-05
CVE-2026-238773.54.30.00512026-01-19
CVE-2025-582861.53.30.00102025-10-11