Weaknesses of type CWE-22

6,633 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2024-46649HIGHeNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder.EPSS 1.0%CVE-2017-20152LOWaerouk imageserve File viewer.php path traversalEPSS 1.0%CVE-2016-10538—The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting userEPSS 1.0%CVE-2023-39459HIGHTriangle MicroWorks SCADA Data Gateway Directory Traversal Arbitrary File Creation VulnerabilityEPSS 1.0%CVE-2022-23620MEDIUMPath traversal in xwiki-platform-skin-skinxEPSS 1.0%CVE-2024-8104HIGHThe Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File DownloadEPSS 1.0%CVE-2024-7146HIGHJetTabs <= 2.2.3 - Authenticated (Contributor+) Arbitrary Local File InclusionEPSS 1.0%CVE-2024-7961HIGHRockwell Automation Path Traversal Vulnerability in Pavilion8®EPSS 1.0%CVE-2022-36943HIGHSSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks.EPSS 1.0%CVE-2024-5349HIGHLA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File InclusionEPSS 1.0%CVE-2024-28993HIGHSolarWinds Access Rights Manager Directory Traversal and Information Disclosure VulnerabilityEPSS 1.0%CVE-2021-31156HIGHAllied Telesis AT-S115 1.2.0 devices before 1.00.024 with Boot Loader 1.00.006 allow Directory Traversal to achieve partial access to data.EPSS 1.0%CVE-2022-3966MEDIUMUltimate Member Plugin Template class-shortcodes.php load_template pathname traversalEPSS 1.0%CVE-2023-2196MEDIUMMissing permission checks in Code Dx Plugin EPSS 1.0%CVE-2023-33524MEDIUMAdvent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enumerates Contact informaEPSS 1.0%CVE-2024-47253HIGHIn 2N Access Commander versions 3.1.1.2 and prior, a Path Traversal vulnerability could allow an attacker with administrative privileges to EPSS 1.0%CVE-2015-10024MEDIUMhoffie larasync file_storage.go path traversalEPSS 1.0%CVE-2024-3195MEDIUMMailCleaner Admin Endpoints path traversalEPSS 1.0%CVE-2023-53944HIGHEasyPHP Webserver 14.1 Path Traversal via Directory Traversal SequencesEPSS 1.0%CVE-2021-38693MEDIUMPath Traversal in thttpdEPSS 1.0%