Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2025-62498HIGHAutomationDirect Productivity Suite Relative Path TraversalEPSS 0.5%CVE-2026-8387LOWRelative Path Traversal in allegroai/clearmlEPSS 0.5%CVE-2025-13161HIGHIQ Service International｜IQ-Support - Arbitrary File ReadEPSS 0.5%CVE-2024-47856CRITICALIn RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or morEPSS 0.5%CVE-2026-27202HIGHGetSimple CMS: Uploaded Files (feature) Arbitrary File Read VulnerabilityEPSS 0.5%CVE-2024-47948MEDIUMIn JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backupsEPSS 0.5%CVE-2026-44941HIGHlibzypp path traversal via "keyhint" in repomd.xmlEPSS 0.5%CVE-2023-35816LOWDevExpress before 23.1.3 allows arbitrary TypeConverter conversion.EPSS 0.5%CVE-2025-24343MEDIUMA vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) atEPSS 0.5%CVE-2024-46664MEDIUMA relative path traversal in Fortinet FortiRecorder [CWE-23] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to reEPSS 0.5%CVE-2026-66906CRITICALApache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDirEPSS 0.5%CVE-2025-15225HIGHSunnet｜WMPro - Arbitrary File ReadEPSS 0.5%CVE-2026-50016HIGHpnpm: Transitive dependency alias path traversal allows project path override via symlink replacementEPSS 0.5%CVE-2025-48977HIGHApache Ignite: REST HTTP arbitrary file read vulnerabilityEPSS 0.5%CVE-2023-30630HIGHDmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode viEPSS 0.5%CVE-2025-9570MEDIUMSunnet｜eHRD CTMS - Arbitrary File Reading through Path TraversalEPSS 0.5%CVE-2026-33494CRITICALOry Oathkeeper has a path traversal authorization bypassEPSS 0.5%CVE-2026-29778HIGHpyLoad: Arbitrary File Write via Path Traversal in edit_package()EPSS 0.5%CVE-2025-23360HIGHNVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successfuEPSS 0.5%CVE-2023-0745MEDIUMArbitrary File Write in High Availability Backup UploadEPSS 0.5%