Weaknesses of type CWE-22

5,991 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2026-61525HIGHZammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling ControllerEPSS 0.4%CVE-2026-102991MEDIUMMako: Path traversal via drive-letter URI on Windows in TemplateLookupEPSS 0.4%CVE-2025-61654NONEUserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanksEPSS 0.4%CVE-2019-0074MEDIUMJunos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure.EPSS 0.4%CVE-2026-59816MEDIUMJoplin: Path traversal in transcribe proxy endpoint via URL-encoded slashEPSS 0.4%CVE-2026-24049HIGHwheel Allows Arbitrary File Permission Modification via Path TraversalEPSS 0.4%CVE-2025-35056MEDIUMNewforma Info Exchange (NIX) limited file readEPSS 0.4%CVE-2026-25328MEDIUMWordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerabilityEPSS 0.4%CVE-2023-0593MEDIUMPath traversal in yaffshivEPSS 0.4%CVE-2025-14867MEDIUMFlashcard Plugin for WordPress <= 0.9 - Authenticated (Contributor+) Arbitrary File Read via Path TraversalEPSS 0.4%CVE-2026-53480LOWDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.4%CVE-2025-62856LOWFile Station 5EPSS 0.4%CVE-2024-39178MEDIUMMyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uuEPSS 0.4%CVE-2023-43802HIGHPath traversal in Arduino Create AgentEPSS 0.4%CVE-2026-76369LOWPath Traversal through Automation Broker in Splunk SOAREPSS 0.4%CVE-2026-97365MEDIUMchonkie-inc littrs lib.rs mount path traversalEPSS 0.4%CVE-2020-10691MEDIUMAn archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. WheEPSS 0.4%CVE-2026-81847MEDIUMMAA-AI MaaMCP pipeline_tools.py load_pipeline path traversalEPSS 0.4%CVE-2026-15687LOWPath traversal via non-tar copyDirectoryFromPodEPSS 0.4%CVE-2024-12429MEDIUMAn attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 versioEPSS 0.4%