Weaknesses of type CWE-22

5,819 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2017-10940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsEPSS 5.4%CVE-2018-0464—Cisco Data Center Network Manager Path Traversal VulnerabilityEPSS 5.4%CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.4%CVE-2021-21090HIGHAdobe InCopy DOCX file parsing directory traversal vulnerability could lead to remote code executionEPSS 5.4%CVE-2019-16765HIGHIf an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension actEPSS 5.4%CVE-2021-21514MEDIUMDell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privEPSS 5.4%CVE-2018-11455—A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6EPSS 5.3%CVE-2020-8159—There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentialEPSS 5.3%CVE-2020-12003—FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContEPSS 5.2%CVE-2021-25082—Popup Builder < 4.0.7 - LFI to RCEEPSS 5.2%CVE-2017-3851—A Directory Traversal vulnerability in the web framework code of the Cisco application-hosting framework (CAF) component of the Cisco IOx apEPSS 5.2%CVE-2013-3993MEDIUMIBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access unEPSS 5.2%KEVCVE-2026-24208MEDIUMNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vEPSS 5.2%CVE-2020-8131—Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead EPSS 5.2%CVE-2019-10220HIGHLinux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.EPSS 5.1%CVE-2026-73034CRITICALDB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id HeaderEPSS 5.1%CVE-2019-12691MEDIUMCisco Firepower Management Center Directory Traversal VulnerabilityEPSS 5.1%CVE-2022-25371—Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizEPSS 5.1%CVE-2021-40661HIGHA remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing TerminEPSS 5.1%CVE-2024-7340HIGHW&B Weave server remote arbitrary file leak and privilege escalationEPSS 5.0%