Weaknesses of type CWE-22

5,809 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2022-27498CRITICALA directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10EPSS 38.3%CVE-2024-55550MEDIUMMitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insuEPSS 37.9%KEVCVE-2024-47010HIGHPath Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.EPSS 37.8%CVE-2023-41474MEDIUMDirectory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via tEPSS 37.6%CVE-2021-37200—A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of an affected system cEPSS 37.4%CVE-2022-24629CRITICALAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory trEPSS 37.2%CVE-2022-1993HIGHPath Traversal in gogs/gogsEPSS 36.3%CVE-2026-5027HIGHLangflow - Path Traversal Arbitrary File Write via upload_user_fileEPSS 36.1%CVE-2021-38163CRITICALSAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administraEPSS 36.0%KEVCVE-2023-51365HIGHQTS, QuTS hero, QuTScloudEPSS 34.8%CVE-2025-2264HIGHSantesoft Sante PACS Server Path Traversal Information DisclosureEPSS 34.8%CVE-2024-10470CRITICALWPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and DeletionEPSS 34.8%CVE-2024-47841MEDIUMPath traversal when loading stylesheetsEPSS 34.6%CVE-2023-39584—Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.EPSS 34.5%CVE-2018-1271—Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configuEPSS 34.4%CVE-2025-2449HIGHNI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution VulnerabilityEPSS 33.7%CVE-2024-13181HIGHPath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresseEPSS 32.4%CVE-2026-48319CRITICALColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 32.3%CVE-2022-45092CRITICALA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the WebEPSS 31.4%CVE-2024-5982CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 31.3%