Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2026-23734CRITICALXWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slashEPSS 19.6%CVE-2022-1661HIGHKeysight N6854A Geolocation server and N6841A RF Sensor softwareEPSS 15.9%CVE-2022-2139MEDIUMAdvantech iViewEPSS 15.6%CVE-2026-41948CRITICALDify v1.14.1 Path Traversal via Plugin Daemon Internal API AccessEPSS 14.5%CVE-2020-10619—An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.EPSS 14.3%CVE-2025-59456MEDIUMIn JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive uploadEPSS 13.0%CVE-2022-1373HIGHSofting Secure Integration Server Relative Path TraversalEPSS 12.8%CVE-2026-34926MEDIUMA directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key tableEPSS 12.7%KEVCVE-2020-8271—Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8EPSS 11.1%CVE-2023-35359HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 9.9%CVE-2025-53609MEDIUMA Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7EPSS 8.9%CVE-2024-24578CRITICALRaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload EPSS 8.7%CVE-2020-5280HIGHLocal file inclusion vulnerability in http4sEPSS 7.0%CVE-2020-8865MEDIUMThis vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. AEPSS 6.8%CVE-2020-25176CRITICALRockwell Automation ISaGRAF5 Runtime Relative Path TraversalEPSS 6.4%CVE-2023-6825CRITICALFile Manager And File Manager Pro (Multiple Versions) - Directory TraversalEPSS 6.0%CVE-2025-47445HIGHWordPress Eventin plugin <= 4.0.26 - Arbitrary File Download VulnerabilityEPSS 5.1%CVE-2012-5972—SpecView Directory TraversalEPSS 5.0%CVE-2024-38258MEDIUMWindows Remote Desktop Licensing Service Information Disclosure VulnerabilityEPSS 4.7%CVE-2017-0918—Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code exeEPSS 4.5%