Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2026-33206HIGHcalibre has a path traversal vulnerabilityEPSS 0.2%CVE-2022-42476HIGHA relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, ForEPSS 0.2%CVE-2026-43616MEDIUMDetect-It-Easy < 3.21 Path Traversal Arbitrary File WriteEPSS 0.2%CVE-2026-53416HIGHZoom VDI - Path TraversalEPSS 0.2%CVE-2025-24819MEDIUMA Relative Path Traversal vulnerability in Nokia MantaRay NMEPSS 0.2%CVE-2026-22070HIGHColorOS Assistant Path Traversal VulnerabilityEPSS 0.2%CVE-2024-54461LOWUnsanitized Filenames in Flutter package file_selector_android Allow File OverwritesEPSS 0.2%CVE-2024-54462LOWUnsanitized Filenames in Flutter package image_picker_android Allow File OverwritesEPSS 0.2%CVE-2025-10203HIGHRelative Path Traversal Vulnerability in Digilent WaveFormsEPSS 0.2%CVE-2022-34378MEDIUMDell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3, contain a relative path traversal vulnerEPSS 0.2%CVE-2022-33937HIGHDell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. A local, low privileged attacker could EPSS 0.2%CVE-2026-81838MEDIUMZip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)EPSS 0.2%CVE-2026-24909MEDIUMvlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.EPSS 0.2%CVE-2026-77113MEDIUMPath Traversal Vulnerability in apport-unpackEPSS 0.2%CVE-2023-34117LOWRelative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via locEPSS 0.2%CVE-2026-47078MEDIUMRelative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypassEPSS 0.2%CVE-2026-39814MEDIUMA relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.1EPSS 0.2%CVE-2026-55062HIGHuniget: Path Traversal in Hook Files - Directory Escape VulnerabilityEPSS 0.2%CVE-2026-58413MEDIUMEnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment dataEPSS 0.2%CVE-2026-58481MEDIUMNetwork-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directoryEPSS 0.2%