Weaknesses of type CWE-22

6,636 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2026-84374HIGHLaravel Excel writes exports outside the configured filesystem disk when given a caller-controlled pathEPSS 0.8%CVE-2025-5158MEDIUMH3C SecCenter SMP-E1114P02 downloadSoftware path traversalEPSS 0.8%CVE-2024-28335CRITICALLektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates dEPSS 0.8%CVE-2025-70084HIGHDirectory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to sensitive information or delete arbitrary files viaEPSS 0.8%CVE-2025-5159MEDIUMH3C SecCenter SMP-E1114P02 download path traversalEPSS 0.8%CVE-2023-41877HIGHGeoServer log file path traversal vulnerabilityEPSS 0.8%CVE-2023-30268CRITICALCLTPHP <=6.0 is vulnerable to Improper Input Validation.EPSS 0.8%CVE-2026-104743MEDIUMTainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass AssignmentEPSS 0.8%CVE-2026-69110CRITICALOpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/musicEPSS 0.8%CVE-2026-58015MEDIUMGlib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receiveEPSS 0.8%CVE-2026-82077HIGHPaperCut NG/MF: Remote Code Execution via Scan2FaxEPSS 0.8%CVE-2023-25815LOWGit looks for localized messages in the wrong placeEPSS 0.8%CVE-2026-74235MEDIUMGFI Exinda AI / ClearView < 7.6.5 Path Traversal via Configuration Download HandlerEPSS 0.8%CVE-2024-57170MEDIUMSOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticatEPSS 0.8%CVE-2026-113672CRITICALArgo CD: A Jsonnet import can read files from the repo-serverEPSS 0.8%CVE-2026-3839HIGHUnraid Authentication Request Path Traversal Authentication Bypass VulnerabilityEPSS 0.8%CVE-2024-22232HIGHSpecially crafted url can be created which leads to a directory traversal in the salt file serverEPSS 0.8%CVE-2026-38993MEDIUMCockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackersEPSS 0.8%CVE-2024-46646MEDIUMeNMS up to 4.7.1 is vulnerable to Directory Traversal via /download/file.EPSS 0.8%CVE-2025-50348HIGHPHPGurukul Pre-School Enrollment System Project V1.0 is vulnerable to Directory Traversal in update-class-pic.php.EPSS 0.8%