Weaknesses of type CWE-22

5,807 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2024-9047CRITICALWordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.phpEPSS 93.3%CVE-2024-7399HIGHImproper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackEPSS 91.9%KEVCVE-2022-37042CRITICALZimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypaEPSS 91.9%KEVCVE-2020-27871HIGHThis vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. AlthouEPSS 90.8%CVE-2025-6218HIGHRARLAB WinRAR Directory Traversal Remote Code Execution VulnerabilityEPSS 90.5%KEVCVE-2021-20123HIGHA local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet eEPSS 90.2%KEVCVE-2019-7195CRITICALThis external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,EPSS 89.7%KEVCVE-2024-37032HIGHOllama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandlesEPSS 89.6%CVE-2022-24716HIGHPath traversal in Icinga Web 2EPSS 89.4%CVE-2021-43798HIGHGrafana path traversalEPSS 88.5%KEVCVE-2024-36104CRITICALApache OFBiz: Path traversal leading to a RCEEPSS 87.8%CVE-2022-31706CRITICALThe vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operatiEPSS 87.1%CVE-2020-11652MEDIUMAn issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to EPSS 86.2%KEVCVE-2024-1728HIGHLocal File Inclusion in gradio-app/gradioEPSS 85.4%CVE-2019-3799—Directory Traversal with spring-cloud-config-serverEPSS 85.3%CVE-2023-40498CRITICALLG Simple Editor cp Command Directory Traversal Remote Code Execution VulnerabilityEPSS 85.1%CVE-2023-32164HIGHD-Link D-View TftpSendFileThread Directory Traversal Information Disclosure VulnerabilityEPSS 84.9%CVE-2023-41266HIGHA path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 aEPSS 84.8%KEVCVE-2023-38950HIGHA path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplEPSS 84.7%KEVCVE-2015-3035HIGHDirectory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0)EPSS 83.9%KEV