Weaknesses of type CWE-22

6,561 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2024-24997HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 3.2%CVE-2019-3880MEDIUMA flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could useEPSS 3.2%CVE-2024-27976HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 3.2%CVE-2022-24830MEDIUMPath Traversal in OpenClinicaEPSS 3.2%CVE-2024-42471HIGHArbitrary File Write via artifact extraction in actions/artifactEPSS 3.2%CVE-2020-15640HIGHThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64.EPSS 3.2%CVE-2020-15641HIGHThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64.EPSS 3.2%CVE-2024-57248MEDIUMDirectory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure,EPSS 3.2%CVE-2023-35169CRITICALphp-imap vulnerable to RCE through a directory traversal vulnerabilityEPSS 3.2%CVE-2017-16197—qinserve is a static file server. qinserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placEPSS 3.2%CVE-2019-10197MEDIUMA flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters wEPSS 3.2%CVE-2022-39261HIGHTwig may load a template outside a configured directory when using the filesystem loaderEPSS 3.2%CVE-2024-27173CRITICALinsecure uploadEPSS 3.2%CVE-2024-32399HIGHDirectory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information viaEPSS 3.2%CVE-2024-23946MEDIUMApache OFBiz: Path traversal or file inclusionEPSS 3.1%CVE-2020-36728MEDIUMAdning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path TraversalEPSS 3.1%CVE-2019-10137HIGHA path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote,EPSS 3.1%CVE-2024-36117HIGHPath traversal while serving Reposilite javadoc expanded filesEPSS 3.1%CVE-2021-36031HIGHMagento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code ExecutionEPSS 3.1%CVE-2024-55457MEDIUMMasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by EPSS 3.1%