Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2026-57988HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2021-41127HIGHMaliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasaEPSS 0.8%CVE-2018-5448MEDIUMMedtronic 2090 Carelink Programmer Relative Path TraversalEPSS 0.7%CVE-2024-24938MEDIUMIn JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentationEPSS 0.7%CVE-2024-54154HIGHIn JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandboxEPSS 0.7%CVE-2023-1043MEDIUMMuYuCMS index.php path traversalEPSS 0.7%CVE-2024-3497HIGHDirectory Traversal Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-8134CRITICALConcrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File InclusionEPSS 0.7%CVE-2025-48957HIGHAstrBot Has Path Traversal Vulnerability in /api/chat/get_fileEPSS 0.7%CVE-2025-23011HIGHFedora Repository archive extraction path traversalEPSS 0.7%CVE-2024-45816MEDIUMStorage bucket Directory Traversal in @backstage/plugin-techdocs-backendEPSS 0.7%CVE-2026-63043HIGHApache InLong: Agent path traversal via unvalidated file source pathEPSS 0.7%CVE-2024-10200HIGHWellchoose Administrative Management System - Arbitrary File Read through Path TraversalEPSS 0.7%CVE-2024-0550CRITICALPrivileged User using traversal to read system filesEPSS 0.7%CVE-2024-33615HIGHCyberPower PowerPanel business Relative Path TraversalEPSS 0.7%CVE-2025-8464MEDIUMDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` CookieEPSS 0.7%CVE-2026-33435HIGHWeblate: Remote code execution during backup restorationEPSS 0.7%CVE-2025-30159MEDIUMKirby vulnerable to path traversal of snippet names in the `snippet()` helperEPSS 0.7%CVE-2022-22245MEDIUMJunos OS: Path traversal vulnerability in J-WebEPSS 0.7%CVE-2025-66626HIGHargoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic linksEPSS 0.7%