Weaknesses of type CWE-22

6,561 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2023-27640HIGHAn issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged wEPSS 3.6%CVE-2018-13812—A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor PanelsEPSS 3.6%CVE-2017-11511—The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filEPSS 3.6%CVE-2023-27639HIGHAn issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged wEPSS 3.6%CVE-2022-24311—A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing fileEPSS 3.5%CVE-2023-3533CRITICALChamilo LMS Unauthenticated Remote Code Execution via Arbitrary File WriteEPSS 3.5%CVE-2021-21037HIGHAcrobat Reader DC Path Traversal Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 3.5%CVE-2020-13550HIGHA local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted applicEPSS 3.5%CVE-2019-13532—CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow EPSS 3.5%CVE-2020-19678HIGHDirectory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensiEPSS 3.5%CVE-2022-24312—A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing fileEPSS 3.5%CVE-2026-54617CRITICALGravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandlerEPSS 3.5%CVE-2025-59304CRITICALA directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via EPSS 3.5%CVE-2024-13158HIGHAn unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allowEPSS 3.4%CVE-2023-39460HIGHTriangle MicroWorks SCADA Data Gateway Event Log Directory Traversal Arbitrary File Creation VulnerabilityEPSS 3.4%CVE-2022-48253CRITICALnhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote serveEPSS 3.4%CVE-2023-28458MEDIUMpretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the stEPSS 3.4%CVE-2019-16776HIGHUnauthorized File Access in npm CLI before before version 6.13.3EPSS 3.4%CVE-2022-45269HIGHA directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitraryEPSS 3.4%CVE-2017-16591—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise ManagEPSS 3.4%