Weaknesses of type CWE-22

5,807 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2024-27921HIGHGrav File Upload Path Traversal vulnerabilityEPSS 60.6%CVE-2023-34259MEDIUMKyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on theEPSS 60.5%CVE-2024-48914CRITICALVendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategyEPSS 60.4%CVE-2023-26361MEDIUMAdobe ColdFusion Directory Traversal Arbitrary file system read VulnerabilityEPSS 58.7%CVE-2020-15643HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougEPSS 58.7%CVE-2023-28127HIGHA path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosuEPSS 58.6%CVE-2019-6111MEDIUMAn issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directorieEPSS 58.2%CVE-2021-43813MEDIUMDirectory Traversal in GrafanaEPSS 58.0%CVE-2022-29517CRITICALA directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A speciEPSS 57.6%CVE-2017-16597—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7EPSS 57.3%CVE-2024-27317HIGHApache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File ModificationEPSS 56.9%CVE-2022-48323CRITICALSunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenEPSS 56.8%CVE-2025-1661CRITICALHUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File InclusionEPSS 56.4%CVE-2024-47011HIGHPath Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive informationEPSS 56.3%CVE-2025-43566MEDIUMColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 55.1%CVE-2024-38819HIGHApplications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacksEPSS 54.9%CVE-2017-16603—This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems EnterpEPSS 54.0%CVE-2014-0130HIGHDirectory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails beforEPSS 53.7%KEVCVE-2021-43778CRITICALPath traversal in GLPI barcode pluginEPSS 52.7%CVE-2024-41163HIGHA directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can leEPSS 52.5%