Weaknesses of type CWE-22

6,634 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2025-7107MEDIUMSimStudioAI sim route.ts handleLocalFile path traversalEPSS 0.9%CVE-2022-43264HIGHArobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via EPSS 0.9%CVE-2025-46783CRITICALPath traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If this vulnerability is exploited, arbitEPSS 0.9%CVE-2022-44016HIGHAn issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing anEPSS 0.9%CVE-2026-17340CRITICALMultiple Vulnerabilities in IBM API ConnectEPSS 0.9%CVE-2023-48660HIGH Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this EPSS 0.9%CVE-2026-16777MEDIUMStore Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' ParameterEPSS 0.9%CVE-2020-36651MEDIUMyoungerheart nodeserver nodeserver.js path traversalEPSS 0.9%CVE-2021-39369MEDIUMIn Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to aEPSS 0.9%CVE-2024-22050HIGHIodine Static File Server Path Traversal VulnerabilityEPSS 0.9%CVE-2022-46154HIGHArbitrary file access in KodExplorerEPSS 0.9%CVE-2024-41511LOWA Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers EPSS 0.9%CVE-2026-14975MEDIUMWP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' ParameterEPSS 0.9%CVE-2022-37906MEDIUMAn authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability resEPSS 0.9%CVE-2025-61923MEDIUMPrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosureEPSS 0.9%CVE-2018-25184MEDIUMSurreal ToDo 0.6.1.2 Local File Inclusion via index.phpEPSS 0.9%CVE-2023-24815MEDIUMDisclosure of classpath resources on Windows when mounted on a wildcard route in vertx-webEPSS 0.9%CVE-2025-55988HIGHAn issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via EPSS 0.9%CVE-2026-75098HIGHProduct Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-designEPSS 0.9%CVE-2023-5504HIGHBackWPup <= 4.0.1 - Authenticated (Administrator+) Directory TraversalEPSS 0.9%