Weaknesses of type CWE-22

6,630 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2022-25936HIGHVersions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable. EPSS 1.4%CVE-2024-46446CRITICALMecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. ParameterEPSS 1.4%CVE-2023-44169—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php.EPSS 1.4%CVE-2023-43216—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.EPSS 1.4%CVE-2023-44172—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php.EPSS 1.4%CVE-2023-44171—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php.EPSS 1.4%CVE-2023-44170—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php.EPSS 1.4%CVE-2021-24447—WP Image Zoom < 1.47 - Local File InclusionEPSS 1.4%CVE-2026-59863HIGHKiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRFEPSS 1.4%CVE-2026-55224HIGHMineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/UninstallEPSS 1.4%CVE-2024-13725CRITICALKeap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File InclusionEPSS 1.4%CVE-2018-16473—A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.EPSS 1.4%CVE-2019-1765HIGHCisco IP Phone 8800 Series Path Traversal VulnerabilityEPSS 1.4%CVE-2022-45299CRITICALAn issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.EPSS 1.4%CVE-2025-54386HIGHTraefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code ExecutionEPSS 1.4%CVE-2026-76506HIGHCisco Unified Computing System Central Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-40524CRITICALDirectory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\application.py EPSS 1.4%CVE-2019-3902MEDIUMA flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and EPSS 1.4%CVE-2021-24692—Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path TraversalEPSS 1.4%CVE-2026-67918HIGHDirectory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath fuEPSS 1.4%