CWE · MITRE source
CWE-26Path Traversal: '/dir/../filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.
This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory. The '/dir/../filename' manipulation is useful for bypassing some path traversal protection schemes. Sometimes a program only checks for "../" at the beginning of the input, so a "/../" can bypass that check.
Last updated: 14 October 2026 20:41 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
ID.RA-01PR.PS-06PR.PS-01SI-10Information Input Validation
—
—
—
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-28064 UPD | 7.5 | 9.8 | 0.0086 | 2024-05-18 |
CVE-2026-15896 | 7.0 | 9.1 | 0.0088 | 2026-10-02 |
CVE-2023-50255 UPD | 6.8 | 9.3 | 0.0105 | 2023-12-27 |
CVE-2024-29466 UPD | 6.8 | 8.8 | 0.0105 | 2024-04-30 |
CVE-2026-76317 UPD | 6.6 | 8.8 | 0.0056 | 2026-08-19 |
CVE-2021-34762 UPD | 6.5 | 8.1 | 0.0199 | 2021-10-27 |
CVE-2021-42021 UPD | 6.2 | 7.5 | 0.0174 | 2021-11-09 |
CVE-2023-25802 UPD | 6.0 | 7.5 | 0.0101 | 2023-03-13 |
CVE-2024-25466 UPD | 5.9 | 7.8 | 0.0053 | 2024-02-16 |
CVE-2024-31551 UPD | 5.9 | 7.5 | 0.0069 | 2024-04-26 |
CVE-2026-25575 | 5.9 | 7.5 | 0.0060 | 2026-02-04 |
CVE-2024-5865 UPD | 5.7 | 7.7 | 0.0048 | 2024-07-02 |
CVE-2024-20345 UPD | 5.5 | 6.5 | 0.0215 | 2024-03-06 |
CVE-2022-45133 UPD | 5.1 | 6.5 | 0.0034 | 2025-08-22 |
CVE-2024-5866 UPD | 4.0 | 5.0 | 0.0038 | 2024-07-02 |
CVE-2026-46747 UPD | 3.7 | 4.3 | 0.0036 | 2026-06-09 |