Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2026-10720MEDIUMMicroCeph path traversal issue in the remote-import APIEPSS 0.3%CVE-2026-77897HIGHMicrosoft Power Automate Desktop Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-54531HIGHIn JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on WindowsEPSS 0.3%CVE-2024-4330MEDIUMPath Traversal in parisneo/lollms-webuiEPSS 0.3%CVE-2025-46363MEDIUMDell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerEPSS 0.3%CVE-2024-24940LOWIn JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archivesEPSS 0.3%CVE-2025-60020MEDIUMnncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.EPSS 0.3%CVE-2025-13199MEDIUMcode-projects Email Logging Interface signup.cpp path traversalEPSS 0.3%CVE-2026-59995MEDIUMsftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attackerEPSS 0.3%CVE-2025-22873LOWImproper access to parent directory of root in osEPSS 0.2%CVE-2023-34394HIGHKeysight N6845A Relative Path TraversalEPSS 0.2%CVE-2022-4123LOWA flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resultingEPSS 0.2%CVE-2024-32116MEDIUMMultiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzEPSS 0.2%CVE-2026-1762LOWEnervista UR Setup Directory Traversal VulnerabilityEPSS 0.2%CVE-2026-60093MEDIUMApache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDirEPSS 0.2%CVE-2023-47613MEDIUMA CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit CiEPSS 0.2%CVE-2024-35274LOWAn improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions EPSS 0.2%CVE-2023-27993MEDIUMA relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary direEPSS 0.2%CVE-2023-32778LOWAn issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.EPSS 0.2%CVE-2025-33112HIGHIBM AIX command executionEPSS 0.2%