Weaknesses of type CWE-22

6,544 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2023-0241—pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or EPSS 8.8%CVE-2026-42600MEDIUMMinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST EndpointEPSS 8.7%CVE-2022-48362HIGHZoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadSerEPSS 8.7%CVE-2018-3714—node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read conEPSS 8.6%CVE-2021-1435MEDIUMCisco IOS XE Software Web UI Command Injection VulnerabilityEPSS 8.5%CVE-2021-21064MEDIUMMagento UPWARD-php Path traversal vulnerability via UPWARD ConnectorEPSS 8.5%CVE-2022-45783MEDIUMAn issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead toEPSS 8.5%CVE-2017-6020—Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize eEPSS 8.5%CVE-2020-3143HIGHCisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Path Traversal VulnerabilityEPSS 8.5%CVE-2017-9640—A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScEPSS 8.5%CVE-2022-24900CRITICALAbsolute Path Traversal due to incorrect use of `send_file` call in Piano LED VisualizerEPSS 8.4%CVE-2024-40348HIGHAn issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.EPSS 8.2%CVE-2026-7474HIGHNomad vulnerable to path traversal in dynamic host volume which may lead to code executionEPSS 8.2%CVE-2025-68143MEDIUMmcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locationsEPSS 8.1%CVE-2026-24479CRITICALHUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCEEPSS 8.1%CVE-2024-31848CRITICALA path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, whicEPSS 8.1%CVE-2024-41922HIGHA directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP reqEPSS 8.1%CVE-2018-17899—LAquis SCADA Versions 4.1.0.3870 and prior has a path traversal vulnerability, which may allow remote code execution.EPSS 8.1%CVE-2024-23477HIGHSolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution VulnerabilityEPSS 7.8%CVE-2021-27825HIGHA directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-static/ URL.EPSS 7.8%