Cyber Resilience

CWE · MITRE source

CWE-36Absolute Path Traversal

Abstraction: Base · CVEs in our corpus: 136

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

Last updated: 22 August 2026 14:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): CAPEC 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • AC-3 Access Enforcement
  • SI-10 Information Input Validation
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2024-13159 KEV 9.99.80.99992025-01-14
CVE-2024-13160 KEV 9.99.80.91252025-01-14
CVE-2024-13161 KEV 9.99.80.90082025-01-14
CVE-2023-3765 9.810.00.67552023-07-19
CVE-2024-48248 KEV 8.88.60.94362025-03-04
CVE-2025-34392 8.79.80.24722025-12-10
CVE-2025-0851 8.69.80.23272025-01-29
CVE-2018-20250 KEV 8.57.80.96272019-02-05
CVE-2024-10811 7.89.80.03592025-01-14
CVE-2024-20401 7.79.80.02282024-07-17
CVE-2025-57790 7.78.80.16812025-08-20
CVE-2024-9924 7.49.80.00832024-10-14
CVE-2024-51549 7.410.00.00542024-12-05
CVE-2025-68472 7.48.10.20082026-01-12
CVE-2022-24877 7.29.90.01142022-05-06
CVE-2024-478837.29.10.01622024-10-24
CVE-2024-21323 7.18.80.03202024-04-09
CVE-2024-29053 7.18.80.03202024-04-09
CVE-2024-2362 7.19.10.01152024-06-06
CVE-2024-10831 7.09.10.00802025-03-20
CVE-2024-10833 7.09.10.00802025-03-20
CVE-2021-21586 6.78.10.04042021-07-15
CVE-2024-8501 6.78.80.00992025-03-20
CVE-2025-6381 6.78.80.00752025-06-28
CVE-2025-7846 6.68.80.00662025-10-31