Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2025-64714MEDIUMPrivateBin's template-switching feature allows arbitrary local file inclusion through path traversalEPSS 0.5%CVE-2026-29098MEDIUMSuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom ActionEPSS 0.5%CVE-2024-22415HIGHUnsecured endpoints in the jupyter-lsp server extensionEPSS 0.5%CVE-2026-82765HIGHPath traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, arbitraryEPSS 0.5%CVE-2026-82768HIGHPath traversal vulnerability exists in SGA1000. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or alterEPSS 0.5%CVE-2023-29377MEDIUMAn issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renamesEPSS 0.5%CVE-2026-55474HIGHSnipe-IT: Directory traversal in displaySigEPSS 0.5%CVE-2026-59149MEDIUMMockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)EPSS 0.5%CVE-2026-21620LOWTFTP Path TraversalEPSS 0.5%CVE-2026-25057CRITICALZip Slip in MarkUs config upload allowing RCEEPSS 0.5%CVE-2022-30299MEDIUMA path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versionsEPSS 0.5%CVE-2025-0225MEDIUMTsinghua Unigroup Electronic Archives System exampleDownload.html path traversalEPSS 0.5%CVE-2025-47788CRITICALMissing Path Validation Enables Path Traversal in Controller.phpEPSS 0.5%CVE-2024-12897MEDIUMIntelbras VIP S4320 G2 Web Interface Sha1Account1 path traversalEPSS 0.5%CVE-2025-27791HIGHCollabora Online Vulnerable to Arbitrary File WriteEPSS 0.5%CVE-2025-53082MEDIUMAn 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations on EPSS 0.5%CVE-2025-58463LOWDownload StationEPSS 0.5%CVE-2026-59832HIGHSiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.dbEPSS 0.5%CVE-2026-23888MEDIUMpnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)EPSS 0.5%CVE-2026-54910HIGHFileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary filesEPSS 0.5%