Weaknesses of type CWE-22

5,839 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2021-43836HIGHPHP file inclusion in the Sulu admin panelEPSS 2.0%CVE-2019-18253—An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.1EPSS 2.0%CVE-2022-31473MEDIUMBIG-IP APM Appliance mode vulnerability CVE-2022-31473EPSS 2.0%CVE-2023-50785LOWZoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal.EPSS 2.0%CVE-2017-15894—Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and beforeEPSS 2.0%CVE-2021-32840HIGHPath Traversal in SharpZipLibEPSS 2.0%CVE-2017-15895—Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authentEPSS 2.0%CVE-2023-30626HIGHJellyfin vulnerable to directory traversal and file write causing arbitrary code executionEPSS 2.0%CVE-2022-43864HIGHIBM Business Automation Workflow information disclosureEPSS 2.0%CVE-2019-10242—In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversEPSS 2.0%CVE-2024-31818CRITICALDirectory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.pEPSS 1.9%CVE-2021-1259MEDIUMCisco SD-WAN vManage Software Path Traversal VulnerabilityEPSS 1.9%CVE-2021-33178—The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. EPSS 1.9%CVE-2017-9270HIGHpost-auth arbitrary file write on cryptctl serverEPSS 1.9%CVE-2025-34110CRITICALColoradoFTP Server <= 1.3 Build 8 Path Traversal Information DisclosureEPSS 1.9%CVE-2022-46256HIGHPath traversal in GitHub Enterprise Server leading to remote code execution in GitHub PagesEPSS 1.9%CVE-2023-22273HIGHZDI-CAN-21307: Adobe RoboHelp Server OnPublishFile Directory Traversal Remote Code Execution VulnerabilityEPSS 1.9%CVE-2023-35840MEDIUM_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.EPSS 1.9%CVE-2014-10068—The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden`EPSS 1.9%CVE-2022-23612HIGHDirectory Traversal in OpenMRS Startup FilterEPSS 1.9%