Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2026-21659HIGHJohnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File InclusionEPSS 0.9%CVE-2024-22398MEDIUMAn improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could alEPSS 0.9%CVE-2023-4897HIGHRelative Path Traversal in mintplex-labs/anything-llmEPSS 0.9%CVE-2023-42783HIGHA relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 throughEPSS 0.9%CVE-2023-4914MEDIUMRelative Path Traversal in cecilapp/cecilEPSS 0.9%CVE-2024-10513HIGHPath Traversal in mintplex-labs/anything-llmEPSS 0.9%CVE-2024-6483MEDIUMArbitrary File/Directory Deletion in aimhubio/aimEPSS 0.9%CVE-2026-8023HIGHPath traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file readEPSS 0.9%CVE-2026-40400HIGHWindows PowerShell Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-62837MEDIUMMicrosoft SharePoint Server Information Disclosure VulnerabilityEPSS 0.9%CVE-2023-31036HIGHCVEEPSS 0.9%CVE-2025-29789MEDIUMOpenEMR Has Directory Traversal in Load Code featureEPSS 0.8%CVE-2025-1588MEDIUMPHPGurukul Online Nurse Hiring System manage-nurse.php path traversalEPSS 0.8%CVE-2023-5189MEDIUMHub: insecure galaxy-importer tarfile extractionEPSS 0.8%CVE-2023-6307MEDIUMjeecgboot JimuReport image path traversalEPSS 0.8%CVE-2024-56340MEDIUMIBM Cognos Analytics path traversalEPSS 0.8%CVE-2021-32964MEDIUMClaroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or ChannelEPSS 0.8%CVE-2026-32725HIGHSciTokens C++: Relative Path Traversal VulnerabilityEPSS 0.8%CVE-2026-49290HIGHSlopsmith has path traversal in archive extractors that allows arbitrary file write → potential RCEEPSS 0.8%CVE-2026-84939CRITICALApache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacksEPSS 0.8%