Weaknesses of type CWE-22

5,851 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2024-23657HIGHPath Traversal: '../filedir' in Nuxt DevtoolsEPSS 1.2%CVE-2019-17324—ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. This cEPSS 1.2%CVE-2020-36321MEDIUMDirectory traversal in development mode handler in Vaadin 14 and 15-17EPSS 1.2%CVE-2024-42469CRITICALCometVisu Backend for openHAB affected by RCE through path traversalEPSS 1.2%CVE-2023-34865CRITICALDirectory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.EPSS 1.2%CVE-2021-32981HIGHAVEVA System Platform Path TraversalEPSS 1.2%CVE-2024-41799HIGHtgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned usersEPSS 1.2%CVE-2023-24188CRITICALureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to bEPSS 1.2%CVE-2026-82460CRITICALCloud Commander before 19.20.2 Directory Traversal via REST and MarkdownEPSS 1.2%CVE-2023-3172MEDIUMPath Traversal in froxlor/froxlorEPSS 1.2%CVE-2023-25803HIGHRoxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversalEPSS 1.2%CVE-2025-61811CRITICALColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 1.2%CVE-2026-6403HIGHQuick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' ParameterEPSS 1.2%CVE-2024-58312HIGHxbtitFM 4.1.18 Unauthenticated Path Traversal in nfogen.phpEPSS 1.2%CVE-2021-3874MEDIUMPath Traversal in bookstackapp/bookstackEPSS 1.2%CVE-2023-24449MEDIUMJenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing EPSS 1.2%CVE-2026-14484CRITICALRapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' ParametersEPSS 1.2%CVE-2023-29736CRITICALKeyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary fEPSS 1.2%CVE-2016-10528—restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1EPSS 1.2%CVE-2022-36113MEDIUMExtracting malicious crates can corrupt arbitrary filesEPSS 1.2%