Weaknesses of type CWE-22

6,542 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2022-45092CRITICALA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the WebEPSS 31.4%CVE-2024-5982CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 31.3%CVE-2018-1271—Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configuEPSS 30.3%CVE-2021-3199CRITICALDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. EPSS 30.2%KEVCVE-2022-47945CRITICALThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_oEPSS 30.2%CVE-2023-52085LOWWinter CMS Local File Inclusion through Server Side Template Injection EPSS 30.2%CVE-2024-25125MEDIUMAbsolute path traversal vulnerability in digdag serverEPSS 29.6%CVE-2012-6664CRITICALMultiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to readEPSS 29.5%CVE-2017-0901—RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any fEPSS 29.4%CVE-2024-32002CRITICALGit's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code ExecutionEPSS 29.2%CVE-2026-20262MEDIUMCisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityEPSS 29.1%KEVCVE-2018-2380MEDIUMSAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thuEPSS 28.9%KEVCVE-2026-22557CRITICALA malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access fEPSS 28.7%CVE-2023-51449MEDIUMMake the `/file` secure against file traversal attacksEPSS 28.3%CVE-2026-59774CRITICALGitea Org-mode file disclosure and code executionEPSS 28.3%CVE-2021-22718—A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and EPSS 28.0%CVE-2025-27590CRITICALIn oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux usEPSS 27.6%CVE-2020-12146MEDIUMSilver Peak Unity OrchestratorTM subject to path traversal.EPSS 27.6%CVE-2025-11001HIGH7-Zip ZIP File Parsing Directory Traversal Remote Code Execution VulnerabilityEPSS 27.4%CVE-2024-30270MEDIUMmailcow Path Traversal and Arbitrary Code Execution VulnerabilityEPSS 27.3%