CWE-26Path Traversal: '/dir/../filename'

Abstraction: Variant · CVEs in our corpus: 18

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory. The '/dir/../filename' manipulation is useful for bypassing some path traversal protection schemes. Sometimes a program only checks for "../" at the beginning of the input, so a "/../" can bypass that check.

Last updated: 21 August 2026 14:15 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

ID.RA-01
PR.PS-06
PR.PS-01
SI-10 Information Input Validation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2024-28064`	7.5	9.8	0.0086	2024-05-18
`CVE-2023-50255`	6.8	9.3	0.0105	2023-12-27
`CVE-2024-29466`	6.8	8.8	0.0105	2024-04-30
`CVE-2021-34762`	6.5	8.1	0.0197	2021-10-27
`CVE-2026-76317`	6.5	8.8	0.0038	2026-08-19
`CVE-2021-42021`	6.2	7.5	0.0169	2021-11-09
`CVE-2023-25802`	6.0	7.5	0.0101	2023-03-13
`CVE-2024-25466`	5.9	7.8	0.0053	2024-02-16
`CVE-2024-31551`	5.9	7.5	0.0069	2024-04-26
`CVE-2026-25575`	5.8	7.5	0.0044	2026-02-04
`CVE-2024-5865`	5.7	7.7	0.0048	2024-07-02
`CVE-2024-20345`	5.5	6.5	0.0215	2024-03-06
`CVE-2022-45133`	5.1	6.5	0.0034	2025-08-22
`CVE-2024-5866`	4.0	5.0	0.0038	2024-07-02
`CVE-2026-46747`	3.6	4.3	0.0024	2026-06-09