Weaknesses of type CWE-22

6,562 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2019-16777HIGHArbitrary File Overwrite in npm CLIEPSS 2.0%CVE-2025-25163HIGHWordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerabilityEPSS 2.0%CVE-2025-67254HIGHNagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.EPSS 2.0%CVE-2018-3787—Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.EPSS 2.0%CVE-2011-10009HIGHS40 CMS 0.4.2 Path TraversalEPSS 2.0%CVE-2021-48014CRITICALFineReport 9.0 Unauthenticated Path Traversal File Write via ReportServerEPSS 2.0%CVE-2024-24398CRITICALDirectory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitraryEPSS 2.0%CVE-2023-28413CRITICALDirectory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitEPSS 2.0%CVE-2022-43864HIGHIBM Business Automation Workflow information disclosureEPSS 2.0%CVE-2024-48510CRITICALDirectory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.SharedEPSS 2.0%CVE-2024-7603HIGHLogsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion VulnerabilityEPSS 2.0%CVE-2024-7600HIGHLogsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion VulnerabilityEPSS 2.0%CVE-2024-11664HIGHeNMS TGZ File controller.py multiselect_filtering path traversalEPSS 2.0%CVE-2022-48483HIGH3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/dowEPSS 2.0%CVE-2026-18051CRITICALW3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache KeyEPSS 2.0%CVE-2018-3731—public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read EPSS 2.0%CVE-2018-3730—mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to reaEPSS 2.0%CVE-2018-3727—626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read contentEPSS 2.0%CVE-2018-3725—hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read conteEPSS 2.0%CVE-2025-27222HIGHTRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesnEPSS 2.0%