Weaknesses of type CWE-180

48 results

Validação antes da canonicalização

A fraqueza ocorre quando o código valida entrada usando uma forma não-canônica, mas processa a mesma entrada em forma canônica depois. Um atacante pode contornar a validação usando representações alternativas (como `../` vs `..\ ` ou encoded characters) que passam na checagem inicial mas se transformam em payloads perigosos após normalização.

Example

Um WAF valida uma URL procurando por `../../../etc/passwd`, a bloqueia, mas o servidor depois decodifica `..%2f..%2f..%2fetc%2fpasswd` (que passou na validação) e executa o path traversal. Ou uma checagem rejeita `<script>` mas aceita `<ScRiPt>`, que é canonicalizado para minúsculas no parser HTML e executa.

How to mitigate

Canonicalize (normalize) a entrada ANTES de validar, não depois. Aplique decoding, lowercase, remoção de espaços e resolução de paths antes de qualquer checagem de segurança. Use whitelist rigorosa de caracteres permitidos após normalização completa.

CVE-2022-26136CRITICALA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third pEPSS 5.7%CVE-2022-26137HIGHA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked wEPSS 2.4%CVE-2026-39364HIGHVite has a `server.fs.deny` bypass with queriesEPSS 2.3%CVE-2025-43716MEDIUMA directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /cliEPSS 1.5%CVE-2026-73420CRITICALNextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassEPSS 0.7%CVE-2026-82481HIGHThe cohttp package before 6.3.0 for OCaml allows directory traversal.EPSS 0.7%CVE-2026-73416MEDIUMjupyterlab: PyPI extension blocklist package-name canonicalization bypassEPSS 0.7%CVE-2026-100230MEDIUMInput Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versEPSS 0.7%CVE-2026-24895HIGHFrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary filesEPSS 0.6%CVE-2026-27590HIGHCaddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transportEPSS 0.6%CVE-2026-114622HIGHbaserCMS: Encoded path traversal bypass in the theme file APIEPSS 0.6%CVE-2025-29787HIGHzip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File WriteEPSS 0.6%CVE-2026-49984HIGHKestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)EPSS 0.6%CVE-2026-90813MEDIUMcosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalizeEPSS 0.6%CVE-2026-95811MEDIUMLemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict itEPSS 0.6%CVE-2026-105050HIGHPeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation EPSS 0.5%CVE-2026-110846HIGHn8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-WebhookEPSS 0.5%CVE-2026-92899MEDIUMApache WSS4J: UsernameToken replay protection bypassed by re-encoding the NonceEPSS 0.5%CVE-2026-100409HIGHOpenNext Cloudflare: Cache interception can bypass middleware protection for encoded pathsEPSS 0.5%CVE-2026-52747HIGHModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassEPSS 0.5%