Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2026-29101MEDIUMSuiteCRM Vulnerable to Directory Traversal to DoS in ModulesEPSS 0.5%CVE-2026-25575HIGHNavigaTUM has a Path Traversal Vulnerability in the propose_edits functionalityEPSS 0.5%CVE-2025-7146HIGHJhenggao iPublish System - Arbitrary File Reading through Path TraversalEPSS 0.5%CVE-2026-27202HIGHGetSimple CMS: Uploaded Files (feature) Arbitrary File Read VulnerabilityEPSS 0.5%CVE-2026-57871HIGHRelative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. EPSS 0.5%CVE-2025-15225HIGHSunnet｜WMPro - Arbitrary File ReadEPSS 0.5%CVE-2026-6540HIGHL7 policy bypass via unnormalized HTTP path matchingEPSS 0.5%CVE-2026-34926MEDIUMA directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key tableEPSS 0.5%KEVCVE-2026-8073HIGHKirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIPEPSS 0.5%CVE-2026-8387LOWRelative Path Traversal in allegroai/clearmlEPSS 0.5%CVE-2025-62498HIGHAutomationDirect Productivity Suite Relative Path TraversalEPSS 0.5%CVE-2024-47856CRITICALIn RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or morEPSS 0.5%CVE-2026-43533HIGHOpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media TagsEPSS 0.5%CVE-2025-13161HIGHIQ Service International｜IQ-Support - Arbitrary File ReadEPSS 0.5%CVE-2024-47948MEDIUMIn JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backupsEPSS 0.5%CVE-2026-44941HIGHlibzypp path traversal via "keyhint" in repomd.xmlEPSS 0.5%CVE-2025-24343MEDIUMA vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) atEPSS 0.5%CVE-2024-46664MEDIUMA relative path traversal in Fortinet FortiRecorder [CWE-23] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to reEPSS 0.5%CVE-2026-50016HIGHpnpm: Transitive dependency alias path traversal allows project path override via symlink replacementEPSS 0.5%CVE-2026-26362HIGHDell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote acceEPSS 0.5%