Weaknesses of type CWE-22

5,863 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2026-37007CRITICALA vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversEPSS 1.0%CVE-2026-2743CRITICALSEPPmail User Web Interface Arbitrary File Write to RCEEPSS 1.0%CVE-2023-46886CRITICALDreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the tEPSS 1.0%CVE-2025-69820MEDIUMDirectory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath funEPSS 1.0%CVE-2023-30620HIGHArbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdbEPSS 1.0%CVE-2016-10538—The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting userEPSS 1.0%CVE-2023-40160LOWDirectory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 producEPSS 1.0%CVE-2026-2953MEDIUMDromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversalEPSS 1.0%CVE-2026-25770CRITICALWazuh has Privilege Escalation to Root via Cluster Protocol File WriteEPSS 1.0%CVE-2024-50649CRITICALThe user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.EPSS 1.0%CVE-2023-38695MEDIUMcypress-image-snapshot vulnerable to insecure snapshot file namesEPSS 1.0%CVE-2022-43858MEDIUMIBM Navigator for i information disclosureEPSS 1.0%CVE-2023-31483HIGHtar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.17 has a directory traversal during extraction that allows the attacker to createEPSS 1.0%CVE-2024-40550HIGHAn arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers tEPSS 1.0%CVE-2022-43857MEDIUMIBM Navigator for i information disclosureEPSS 1.0%CVE-2024-25711HIGHdiffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may bEPSS 1.0%CVE-2026-48055CRITICALStreambert: Arbitrary File Write (Zip Slip) via Subtitle ExtractionEPSS 1.0%CVE-2026-35718MEDIUMA path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attaEPSS 1.0%CVE-2023-0454HIGHOrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible becauEPSS 1.0%CVE-2024-33274HIGHDirectory Traversal vulnerability in FME Modules customfields v.2.2.7 and before allows a remote attacker to obtain sensitive information viEPSS 1.0%