Weaknesses of type CWE-22

6,544 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2024-11238MEDIUMLandray EKP sysUiComponent.do delPreviewFile path traversalEPSS 5.7%CVE-2022-41840HIGHWordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerabilityEPSS 5.7%CVE-2026-73034CRITICALDB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id HeaderEPSS 5.7%CVE-2025-46704MEDIUMAdvantech iView Path TraversalEPSS 5.7%CVE-2024-45256CRITICALAn arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite databaseEPSS 5.6%CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.6%CVE-2023-31059HIGHRepetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLosEPSS 5.6%CVE-2018-1002209—QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip EPSS 5.5%CVE-2022-25371—Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizEPSS 5.4%CVE-2025-34452HIGHStreama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File WriteEPSS 5.4%CVE-2017-10940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsEPSS 5.4%CVE-2018-0464—Cisco Data Center Network Manager Path Traversal VulnerabilityEPSS 5.4%CVE-2020-8159—There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentialEPSS 5.4%CVE-2021-21090HIGHAdobe InCopy DOCX file parsing directory traversal vulnerability could lead to remote code executionEPSS 5.4%CVE-2019-16765HIGHIf an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension actEPSS 5.4%CVE-2020-12003—FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContEPSS 5.4%CVE-2021-21514MEDIUMDell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privEPSS 5.4%CVE-2018-11455—A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6EPSS 5.2%CVE-2021-25082—Popup Builder < 4.0.7 - LFI to RCEEPSS 5.2%CVE-2017-3851—A Directory Traversal vulnerability in the web framework code of the Cisco application-hosting framework (CAF) component of the Cisco IOx apEPSS 5.2%