Weaknesses of type CWE-22

5,775 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2022-2119HIGHOFFIS DCMTK Path TraversalEPSS 3.2%CVE-2023-35169CRITICALphp-imap vulnerable to RCE through a directory traversal vulnerabilityEPSS 3.2%CVE-2024-27173CRITICALinsecure uploadEPSS 3.2%CVE-2024-32399HIGHDirectory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information viaEPSS 3.2%CVE-2019-13532—CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow EPSS 3.2%CVE-2024-23946MEDIUMApache OFBiz: Path traversal or file inclusionEPSS 3.1%CVE-2017-9511HIGHThe MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary fileEPSS 3.1%CVE-2020-36728MEDIUMAdning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path TraversalEPSS 3.1%CVE-2026-24897CRITICALAuthenticated Remote Code Execution via Arbitrary File UploadEPSS 3.1%CVE-2019-10137HIGHA path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote,EPSS 3.1%CVE-2024-55457MEDIUMMasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by EPSS 3.1%CVE-2024-36117HIGHPath traversal while serving Reposilite javadoc expanded filesEPSS 3.1%CVE-2021-36031HIGHMagento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code ExecutionEPSS 3.1%CVE-2022-38485MEDIUMA directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authentEPSS 3.1%CVE-2017-2595HIGHIt was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via pEPSS 3.1%CVE-2022-45269HIGHA directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitraryEPSS 3.1%CVE-2024-24565MEDIUMCrateDB database has an arbitrary file read vulnerabilityEPSS 3.1%CVE-2024-45598MEDIUMCacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log PathEPSS 3.1%CVE-2024-25000HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 3.0%CVE-2021-24820—Cost Calculator <= 1.6 - Authenticated Local File InclusionEPSS 3.0%