Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2024-47051CRITICALRemote Code Execution & File Deletion in Asset UploadsEPSS 1.8%CVE-2025-55748CRITICALXWiki Platform's configuration files can be accessed through jsx and sx endpointsEPSS 1.8%CVE-2022-23732—Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protectionsEPSS 1.7%CVE-2023-20066MEDIUMCisco IOS XE Software Web UI Path Traversal VulnerabilityEPSS 1.7%CVE-2025-55747CRITICALXWiki Platform's configuration files can be accessed through the webjars APIEPSS 1.7%CVE-2019-3976—RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgradeEPSS 1.7%CVE-2025-46002MEDIUMAn issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanEPSS 1.7%CVE-2019-11826HIGHRelative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users EPSS 1.7%CVE-2025-59341HIGHLocal File Inclusion in esm.shEPSS 1.6%CVE-2019-13944—A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versiEPSS 1.6%CVE-2025-52207CRITICALPBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.EPSS 1.6%CVE-2020-25150HIGHB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusEPSS 1.5%CVE-2022-38205HIGHPortal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)EPSS 1.5%CVE-2020-10631—An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.EPSS 1.5%CVE-2024-20352MEDIUMA vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which coEPSS 1.5%CVE-2022-20862MEDIUMCisco Unified Communications Manager Arbitrary File Read VulnerabilityEPSS 1.5%CVE-2020-7861HIGHAnySupport directory traversing vulnerabilityEPSS 1.5%CVE-2021-41242HIGHPath Traversal in some REST methods leading to file upload to arbitrary placesEPSS 1.4%CVE-2020-3597MEDIUMCisco Nexus Data Broker Software Path Traversal VulnerabilityEPSS 1.4%CVE-2022-39345CRITICALGin-vue-admin arbitrary file upload vulnerability caused by path traversalEPSS 1.4%