Weaknesses of type CWE-22

6,507 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2022-38485MEDIUMA directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authentEPSS 4.1%CVE-2022-46945CRITICALNagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.EPSS 4.1%CVE-2017-16598—This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of NetGain Systems EntEPSS 4.1%CVE-2017-16606—This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems EnterpEPSS 4.1%CVE-2023-33510HIGHJeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.EPSS 4.1%CVE-2020-7478—A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), EPSS 4.1%CVE-2019-10185HIGHIt was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. EPSS 4.0%CVE-2025-2749HIGHKentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCEEPSS 4.0%KEVCVE-2019-7483HIGHIn SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the preseEPSS 4.0%KEVCVE-2007-5927HIGHDirectory traversal vulnerability in OpenBase 10.0.5 and earlier allows remote authenticated users to create files with arbitrary contents vEPSS 4.0%CVE-2024-39722HIGHAn issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in thEPSS 4.0%CVE-2016-7041MEDIUMDrools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory EPSS 4.0%CVE-2018-10589—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 3.9%CVE-2021-21102HIGHAdobe Illustrator DOCX file parsing directory traversal vulnerability could lead to remote code executionEPSS 3.9%CVE-2021-43831HIGHFiles on the host computer can be accessed from the Gradio interfaceEPSS 3.9%CVE-2023-39912MEDIUMZoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is EPSS 3.8%CVE-2017-12694—A Directory Traversal issue was discovered in SpiderControl SCADA Web Server. An attacker may be able to use a simple GET request to performEPSS 3.8%CVE-2022-32573CRITICALA directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafEPSS 3.8%CVE-2021-40525—Sieve file storage vulnerable to path traversal attacksEPSS 3.8%CVE-2025-12055HIGHUnauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution SystemEPSS 3.8%