Weaknesses of type CWE-22

5,814 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2022-1392—Videos sync PDF <= 1.7.4 - Unauthenticated LFIEPSS 11.3%CVE-2026-25895CRITICALFUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APIEPSS 11.2%CVE-2026-27483HIGHMindsDB has Path Traversal in /api/files Leading to Remote Code ExecutionEPSS 11.1%CVE-2026-33309CRITICALLangflow has an Arbitrary File Write (RCE) via v2 APIEPSS 11.1%CVE-2018-1002202—zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip aEPSS 11.0%CVE-2022-41328MEDIUMA improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 thEPSS 10.7%KEVCVE-2018-1002203—unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot sEPSS 10.6%CVE-2018-1002201—zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip aEPSS 10.4%CVE-2025-2636HIGHInstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File InclusionEPSS 10.4%CVE-2018-1002205MEDIUMDotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slaEPSS 10.4%CVE-2025-4524CRITICALMadara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File InclusionEPSS 10.4%CVE-2024-6127CRITICALBC Security Empire Path Traversal RCEEPSS 10.3%CVE-2026-22218HIGHChainlit < 2.9.4 Arbitrary File Read via /project/elementEPSS 10.3%CVE-2022-47501HIGHApache OFBiz: Arbitrary file reading vulnerabilityEPSS 10.2%CVE-2022-47875HIGHA Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary codeEPSS 10.2%CVE-2020-17389HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougEPSS 10.1%CVE-2020-17387HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougEPSS 10.1%CVE-2019-1717HIGHCisco Video Surveillance Manager Web-Based Management Interface Information Disclosure VulnerabilityEPSS 10.1%CVE-2018-1002208—SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) inEPSS 9.9%CVE-2025-1035MEDIUMPath Traversal in Komtera Technolgies' KLog ServerEPSS 9.9%