Weaknesses of type CWE-22

6,038 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2026-19325MEDIUMIncomeStreamSurfer roo-code-memory-bank-mcp-server read_memory_bank_file/append_memory_bank_entry index.ts appendMemoryBankEntry path traversalEPSS 0.2%CVE-2026-15751MEDIUMmastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversalEPSS 0.2%CVE-2026-15749MEDIUMmastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversalEPSS 0.2%CVE-2026-19288MEDIUMastralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversalEPSS 0.2%CVE-2026-19270MEDIUMHulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversalEPSS 0.2%CVE-2026-19285MEDIUMaaronsb memory-graph memoryTools.ts JsonMemoryStorage.saveMemories path traversalEPSS 0.2%CVE-2026-15522MEDIUMtugcantopaloglu godot-mcp run_project index.js validatePath path traversalEPSS 0.2%CVE-2026-49219MEDIUMImageMagick: Policy Bypass can read disallowed filesEPSS 0.2%CVE-2026-78043MEDIUMThe Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration dirEPSS 0.2%CVE-2026-11411MEDIUMiAI Lab PDF AI App chatpdf.pro getExternalCacheDir path traversalEPSS 0.2%CVE-2026-35363MEDIUMuutils coreutils rm Safeguard Bypass via Improper Path NormalizationEPSS 0.2%CVE-2025-11696HIGHStudio 5000 ® Simulation Interface SSRFEPSS 0.2%CVE-2026-34446MEDIUMONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX loadEPSS 0.2%CVE-2026-71514LOWNLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec BypassEPSS 0.2%CVE-2024-37129MEDIUMDell Inventory Collector, versions prior to 12.3.0.6 contains a Path Traversal vulnerability. A local authenticated malicious user could potEPSS 0.2%CVE-2026-86886MEDIUMA path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, EPSS 0.2%CVE-2026-20614HIGHA path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe EPSS 0.2%CVE-2026-41124LOWDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.2%CVE-2025-43934MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.2%CVE-2026-73974MEDIUMlinuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)EPSS 0.2%