Weaknesses of type CWE-22

5,840 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2019-5447—A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.EPSS 1.5%CVE-2022-45867HIGHMyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achEPSS 1.5%CVE-2024-34313CRITICALAn issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint.EPSS 1.5%CVE-2016-10561—Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnEPSS 1.5%CVE-2020-7535—A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web EPSS 1.5%CVE-2024-28698CRITICALDirectory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted scripEPSS 1.5%CVE-2023-36827HIGHFides vulnerable to Path Traversal in Webserver APIEPSS 1.5%CVE-2024-9415HIGHPath Traversal in transformeroptimus/superagiEPSS 1.5%CVE-2019-5438—Path traversal using symlink in npm harp module versions <= 0.29.0.EPSS 1.5%CVE-2021-42542HIGHEmerson WirelessHART GatewayEPSS 1.5%CVE-2022-33164HIGHIBM Security Directory Server path traversalEPSS 1.5%CVE-2022-47027CRITICALTimmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionarEPSS 1.5%CVE-2023-27066MEDIUMDirectory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrEPSS 1.5%CVE-2018-3713—angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a maEPSS 1.5%CVE-2023-42000CRITICALArcserve UDP Agent Unauthenticated Path Traversal File Upload EPSS 1.5%CVE-2022-36327MEDIUMPath traversal vulnerability leading to an arbitrary file write in Western Digital devicesEPSS 1.5%CVE-2023-26578HIGHArbitrary File Upload to Web Root In IDAttend’s IDWeb ApplicationEPSS 1.5%CVE-2022-27620MEDIUMImproper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server befoEPSS 1.5%CVE-2022-33897MEDIUMA directory traversal vulnerability exists in the web_server /ajax/remove/ functionality of Robustel R1510 3.1.16. A specially-crafted netwoEPSS 1.5%CVE-2024-9224MEDIUMHello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File ReadEPSS 1.5%