KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Weakness / #6

CWE-22: Path traversal in CISA KEV

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Catalog
2026.09.23
Rank
#6 of 185
MITRE
CWE-22 definition

Answer 79 KEV entries list CWE-22 (Path traversal) as of catalog 2026.09.23, 4.6% of the catalog and rank 6 of 185 weaknesses. The most affected vendor is Rails (3).

Crafted file paths such as ../ let an attacker read or write files outside the intended directory.

KEV entries
794.6% of catalog
Vendors
55affected
Ransomware: known
2734.2%
First added
2021-11-03
Latest added
2026-09-22

VVendors

Vendors with CWE-22 KEV entries
VendorEntriesShare
Rails33.8%
SAP33.8%
Atlassian33.8%
Ivanti33.8%
Apache33.8%
Adobe22.5%
Cisco22.5%
Samsung22.5%
SimpleHelp 22.5%
RARLAB22.5%
Mitel22.5%
DrayTek22.5%

TAdditions by year

CWE-22 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 20; 2022: 22; 2023: 4; 2024: 9; 2025: 13; 2026: 11.01020302021: 20 added2020212022: 22 added2220222023: 4 added420232024: 9 added920242025: 13 added1320252026: 11 added (year to date)112026
CWE-22 KEV additions by year
YearAdded
202120
202222
20234
20249
202513
202611

PProducts

Products with CWE-22 KEV entries
ProductEntriesShare
Rails Ruby on Rails33.8%
Adobe ColdFusion22.5%
Samsung MagicINFO 9 Server22.5%
SimpleHelp SimpleHelp22.5%
SAP NetWeaver22.5%
Mitel MiCollab22.5%
DrayTek VigorConnect22.5%
Fortinet FortiOS22.5%

EAll entries

KEV entries listing CWE-22
CVEVendorProductAddedRansomware
CVE-2026-93616Check PointMultiple Products NewUnknown
CVE-2026-66384JFrogArtifactoryUnknown
CVE-2026-59310BroadcomVMware vCenterKnown
CVE-2026-48282AdobeColdFusionUnknown
CVE-2026-34909UbiquitiUniFi OSUnknown
CVE-2026-20262CiscoCatalyst SD-WAN ManagerUnknown
CVE-2024-1708ConnectWiseScreenConnectKnown
CVE-2024-7399SamsungMagicINFO 9 ServerUnknown
CVE-2024-57728SimpleHelp SimpleHelpKnown
CVE-2025-2749KenticoKentico XperienceUnknown
CVE-2025-8110GogsGogsUnknown
CVE-2025-6218RARLABWinRARUnknown
CVE-2021-43798Grafana LabsGrafanaUnknown
CVE-2019-5418RailsRuby on RailsUnknown
CVE-2024-0769D-LinkDIR-859 RouterUnknown
CVE-2025-4632SamsungMagicINFO 9 ServerUnknown
CVE-2025-27920SrimaxOutput MessengerUnknown
CVE-2023-38950ZKTecoBioTimeUnknown
CVE-2025-34028CommvaultCommand CenterUnknown
CVE-2017-12637SAPNetWeaverUnknown
CVE-2024-4885ProgressWhatsUp GoldUnknown
CVE-2024-57727SimpleHelp SimpleHelpKnown
CVE-2024-55550MitelMiCollabKnown
CVE-2024-41713MitelMiCollabKnown
CVE-2024-11667ZyxelMultiple FirewallsKnown
CVE-2021-26086AtlassianJira Server and Data CenterUnknown
CVE-2019-16278NostromonhttpdUnknown
CVE-2024-8963IvantiCloud Services Appliance (CSA)Unknown
CVE-2024-7262KingsoftWPS OfficeUnknown
CVE-2021-20124DrayTekVigorConnectUnknown
CVE-2021-20123DrayTekVigorConnectUnknown
CVE-2024-32113ApacheOFBizUnknown
CVE-2024-28995SolarWindsServ-UUnknown
CVE-2023-47246SysAidSysAid ServerKnown
CVE-2023-32315Ignite RealtimeOpenfireUnknown
CVE-2023-35081IvantiEndpoint Manager Mobile (EPMM)Unknown
CVE-2022-41328FortinetFortiOSUnknown
CVE-2018-5430TIBCOJasperReportsUnknown
CVE-2018-18809TIBCOJasperReportsUnknown
CVE-2022-26500VeeamBackup & ReplicationKnown
CVE-2022-41352SynacorZimbra Collaboration Suite (ZCS)Known
CVE-2022-26352dotCMSdotCMSKnown
CVE-2020-36193PEARArchive_TarUnknown
CVE-2022-27925SynacorZimbra Collaboration Suite (ZCS)Known
CVE-2022-30333RARLABUnRARKnown
CVE-2019-7195QNAPPhoto StationKnown
CVE-2019-7194QNAPPhoto StationKnown
CVE-2015-0016MicrosoftWindowsUnknown
CVE-2022-29464WSO2Multiple ProductsKnown
CVE-2014-0780InduSoftWeb StudioUnknown
CVE-2019-7483SonicWallSMA100Unknown
CVE-2020-1631JuniperJunos OSUnknown
CVE-2016-0752RailsRuby on RailsUnknown
CVE-2015-4068ArcserveUnified Data Protection (UDP)Unknown
CVE-2015-3035TP-LinkMultiple Archer DevicesUnknown
CVE-2015-0666CiscoPrime Data Center Network Manager (DCNM)Unknown
CVE-2014-0130RailsRuby on RailsUnknown
CVE-2010-2861AdobeColdFusionKnown
CVE-2020-14864OracleIntelligence Enterprise EditionUnknown
CVE-2018-14847MikroTikRouterOSUnknown
CVE-2021-42013ApacheHTTP ServerKnown
CVE-2021-41773ApacheHTTP ServerKnown
CVE-2021-40444MicrosoftMSHTMLKnown
CVE-2021-36741Trend MicroApex One, Apex One as a Service, and Worry-Free Business SecurityUnknown
CVE-2021-20090ArcadyanBuffalo FirmwareUnknown
CVE-2021-20023SonicWallSonicWall Email SecurityKnown
CVE-2020-5902F5BIG-IPKnown
CVE-2020-4430IBMData Risk ManagerUnknown
CVE-2020-11738WordPressSnap Creek Duplicator PluginUnknown
CVE-2020-11652SaltStackSaltUnknown
CVE-2019-3398AtlassianConfluence Server and Data CenterUnknown
CVE-2019-3396AtlassianConfluence Server and Data ServerKnown
CVE-2019-20085TVTNVMS-1000Unknown
CVE-2019-19781CitrixApplication Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKnown
CVE-2019-18187Trend MicroOfficeScanUnknown
CVE-2019-11510IvantiPulse Connect SecureKnown
CVE-2018-2380SAPCustomer Relationship Management (CRM)Known
CVE-2018-13379FortinetFortiOSKnown
CVE-2016-3976SAPNetWeaverUnknown

Cite this

79 CISA KEV entries list CWE-22 (Path traversal), 4.6% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-22/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API