Weaknesses of type CWE-22

6,544 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2018-1002205MEDIUMDotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slaEPSS 10.4%CVE-2024-6127CRITICALBC Security Empire Path Traversal RCEEPSS 10.3%CVE-2022-47501HIGHApache OFBiz: Arbitrary file reading vulnerabilityEPSS 10.2%CVE-2022-47875HIGHA Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary codeEPSS 10.2%CVE-2020-17389HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougEPSS 10.1%CVE-2020-17387HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougEPSS 10.1%CVE-2019-1717HIGHCisco Video Surveillance Manager Web-Based Management Interface Information Disclosure VulnerabilityEPSS 10.1%CVE-2018-1002208—SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) inEPSS 9.9%CVE-2025-1035MEDIUMPath Traversal in Komtera Technolgies' KLog ServerEPSS 9.8%CVE-2026-22218HIGHChainlit < 2.9.4 Arbitrary File Read via /project/elementEPSS 9.7%CVE-2022-32275HIGHGrafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etEPSS 9.5%CVE-2017-20212HIGHFLIR Thermal Camera F/FC/PT/D 8.0.0.64 Information Disclosure via File ReadingEPSS 9.5%CVE-2018-1002206—SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) iEPSS 9.3%CVE-2022-39802—SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameEPSS 9.3%CVE-2020-15644HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougEPSS 9.3%CVE-2020-6142CRITICALA remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cauEPSS 9.2%CVE-2023-43662HIGHArbitrary file read vulnerability in Shoko ServerEPSS 9.1%CVE-2019-3474MEDIUMPath traversal vulnerability in Filr web applicationEPSS 9.0%CVE-2026-20181CRITICALCisco Identity Services Engine Remote Code Execution VulnerabilityEPSS 8.9%CVE-2023-35843HIGHNocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on EPSS 8.9%