CWE-73: External control of file name or path

CVEs per yearBy the year they were published

1. 20141
2. 20183
3. 202016
4. 20218
5. 202220
6. 202339
7. 202475
8. 2025142
9. 2026469

Known exploitedNewest addition to KEV first

• CVE-2026-96656

  Plex Media Server arbitrary file write

  Plex · Media Server

  ExploitedHigh8.6
• CVE-2025-33053

  Internet Shortcut Files Remote Code Execution Vulnerability

  Microsoft · Windows 10 Version 1507

  ExploitedHigh8.8
• CVE-2025-24054

  NTLM Hash Disclosure Spoofing Vulnerability

  Microsoft · Windows 10 Version 1507

  ExploitedMedium6.5
• CVE-2025-0111

  PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

  Palo Alto Networks · Cloud NGFW

  ExploitedHigh7.1
• CVE-2024-43451

  NTLM Hash Disclosure Spoofing Vulnerability

  Microsoft · Windows Server 2025

  ExploitedMedium6.5
• CVE-2020-1631

  Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services

  Juniper Networks · Junos OS

  ExploitedHigh8.8

Newest CVEs

• CVE-2026-124490

  OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument

  openemr · openemr

  Critical9.4
• CVE-2026-124479

  OpenEMR before 8.4.0 Arbitrary File Read via REST Document Download

  openemr · openemr

  High7.1
• CVE-2026-124450

  OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument

  openemr · openemr

  Critical9.3
• CVE-2026-124446

  OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocument

  openemr · openemr

  High8.7
• CVE-2026-104307

  BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_error

  Unknown · BackUpWordPress

  Medium5.4
• CVE-2026-121379

  Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

  Unknown · Tournamatch

  Critical9.6
• CVE-2026-118532

  Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field

  Unknown · Directorist: AI-Powered Business Directory, Listings & Classified Ads

  Medium6.5
• CVE-2026-17331

  Multiple Vulnerabilities in IBM API Connect

  IBM · API Connect

  High7.5
• CVE-2026-85736

  Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths

  chartbrew · chartbrew

  High8.1
• CVE-2026-102344

  Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server

  kunchenguid · lavish-axi

  High8.1

Vendors it comes up for most

1. Microsoft61
2. SourceCodester14
3. IBM13
4. WWBN12
5. Siemens11
6. Cisco10
7. Palo Alto Networks10
8. Red Hat8
9. Apache Software Foundation7
10. Dell6