Weaknesses of type CWE-22

5,807 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2014-0750—GE Proficy HMI/SCADA Path TraversalEPSS 70.2%CVE-2021-32682CRITICALMultiple vulnerabilities leading to RCEEPSS 69.9%CVE-2023-40497CRITICALLG Simple Editor saveXml Directory Traversal Remote Code Execution VulnerabilityEPSS 69.4%CVE-2022-44635HIGHApache Fineract allowed an authenticated user to perform remote code execution due to path traversalEPSS 68.8%CVE-2023-40028MEDIUMArbitrary file read via symlinks in GhostEPSS 68.7%CVE-2020-4430MEDIUMIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An aEPSS 68.5%KEVCVE-2024-23535HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 68.1%CVE-2024-24994HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 68.1%CVE-2021-29492HIGHBypass of path matching rules using escaped slash charactersEPSS 66.2%CVE-2021-39316HIGHZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information DislosureEPSS 65.8%CVE-2026-34909CRITICALA malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the uEPSS 65.0%KEVCVE-2022-31474HIGHWordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory TraversalEPSS 63.8%CVE-2022-30547CRITICALA directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specialEPSS 63.7%CVE-2015-4068CRITICALDirectory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denEPSS 63.6%KEVCVE-2023-35081HIGHA path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticatEPSS 63.6%KEVCVE-2024-13179HIGHPath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.EPSS 63.0%CVE-2023-34096MEDIUMThruk has Path Traversal Vulnerability in panorama.pmEPSS 62.7%CVE-2024-6781HIGHCalibre Arbitrary File ReadEPSS 62.4%CVE-2023-41182HIGHNETGEAR ProSAFE Network Management System ZipUtils Directory Traversal Remote Code Execution VulnerabilityEPSS 62.3%CVE-2020-27128MEDIUMCisco SD-WAN vManage Software Arbitrary File Creation VulnerabilityEPSS 60.8%