Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2023-40714CRITICALA relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to esEPSS 0.6%CVE-2026-59792CRITICALIn JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possibleEPSS 0.6%CVE-2025-44163MEDIUMRaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a craftEPSS 0.6%CVE-2024-9923MEDIUMTEAMPLUS TECHNOLOGY Team+ - Arbitrary File Move through Path TraversalEPSS 0.6%CVE-2026-48681MEDIUMOpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.EPSS 0.6%CVE-2026-25707HIGHHandcrafted repo metadata may cause arbitrary local files to be overwritten by libzyppEPSS 0.6%CVE-2024-54449HIGHRemote Code Execution (RCE) via Arbitrary File Write In Document APIEPSS 0.6%CVE-2026-80133HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path TravEPSS 0.6%CVE-2025-62552HIGHMicrosoft Access Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-6583MEDIUMPath Traversal in stangirard/quivrEPSS 0.6%CVE-2026-27489HIGHONNX: Path Traversal via SymlinkEPSS 0.6%CVE-2024-49253HIGHWordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerabilityEPSS 0.6%CVE-2025-49466MEDIUMaerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachmentEPSS 0.6%CVE-2026-85199HIGHEclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiersEPSS 0.6%CVE-2024-22096MEDIUMRelative Path Traversal in Rapid SCADAEPSS 0.6%CVE-2025-55013MEDIUMAssemblyline 4 Service Client: Arbitrary Write through path traversal in Client codeEPSS 0.6%CVE-2025-62878CRITICALLocal Path Provisioner vulnerable to Path Traversal via parameters.pathPatternEPSS 0.6%CVE-2026-66907HIGHApache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the resultEPSS 0.6%CVE-2025-22859MEDIUMA Relative Path Traversal vulnerability [CWE-23] in FortiClientEMS 7.4.0 through 7.4.1 and FortiClientEMS Cloud 7.4.0 through 7.4.1 may alloEPSS 0.6%CVE-2024-13130MEDIUMDahua IPC-HFW1200S Web Interface Sha1Account1 path traversalEPSS 0.6%