Weaknesses of type CWE-22

5,808 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2022-35919HIGHAuthenticated requests for server update admin API allows path traversal in minioEPSS 52.3%CVE-2023-25652HIGH"git apply --reject" partially-controlled arbitrary file writeEPSS 51.9%CVE-2021-20023MEDIUMSonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on thEPSS 51.4%KEVCVE-2026-59310CRITICALvCenter directory-traversal vulnerabilityEPSS 50.4%KEVCVE-2017-16720—A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structurEPSS 50.3%CVE-2019-15980HIGHCisco Data Center Network Manager Path Traversal VulnerabilitiesEPSS 50.0%CVE-2022-35650—The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks rEPSS 49.1%CVE-2024-46909CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 48.9%CVE-2023-26802CRITICALAn issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass autheEPSS 48.7%CVE-2020-8209—Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10EPSS 48.7%CVE-2020-5377CRITICALDell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated rEPSS 48.3%CVE-2018-0258—A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary fEPSS 48.2%CVE-2022-1476MEDIUMAll-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows HostsEPSS 47.9%CVE-2022-0679—Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCEEPSS 47.8%CVE-2024-25065CRITICALApache OFBiz: Path traversal allowing authentication bypass.EPSS 47.7%CVE-2016-3976HIGHDirectory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot doEPSS 47.3%KEVCVE-2023-26255HIGHAn unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By mEPSS 47.2%CVE-2023-47211CRITICALA directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP requeEPSS 47.0%CVE-2024-5505HIGHNETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution VulnerabilityEPSS 47.0%CVE-2023-46455—In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN cliEPSS 47.0%