Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2018-10615—Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prioEPSS 2.6%CVE-2021-34605HIGHXinje XD/E Series PLC Program Tool Zip SlipEPSS 2.5%CVE-2023-2913HIGHRockwell Automation ThinManager ThinServer Path Traversal VulnerabilityEPSS 2.4%CVE-2026-54066HIGHSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)EPSS 2.4%CVE-2022-31163HIGHTZInfo relative path traversal vulnerability allows loading of arbitrary filesEPSS 2.4%CVE-2024-30010HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 2.3%CVE-2020-12026—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a loEPSS 2.3%CVE-2021-29101HIGHArcGIS GeoEvent Server has a Directory Traversal security vulnerability.EPSS 2.3%CVE-2018-14795—DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace EPSS 2.2%CVE-2020-8254—A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicioEPSS 2.1%CVE-2025-27410MEDIUMPwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as adminEPSS 2.1%CVE-2021-32954—Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbiEPSS 2.1%CVE-2020-25172—B. Braun OnlineSuiteEPSS 2.0%CVE-2019-17640—In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, EPSS 2.0%CVE-2026-31831HIGHTautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpointEPSS 2.0%CVE-2019-13408—Advan VD-1 allows users to download arbitrary filesEPSS 1.9%CVE-2020-7008—VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, EPSS 1.9%CVE-2022-20790MEDIUMCisco Unified Communications Products Arbitrary File Read VulnerabilityEPSS 1.9%CVE-2018-12473LOWpath traversal in obs-service-tar_scmEPSS 1.8%CVE-2021-41178HIGHFile Traversal affecting SVG files on Nextcloud ServerEPSS 1.8%