Weaknesses of type CWE-23

509 results

Traversal de diretório via construção insegura de caminhos

A aplicação usa entrada do usuário para montar um caminho de arquivo dentro de um diretório restrito, mas não neutraliza sequências como '..' que permitem navegar para fora desse limite. Um atacante consegue ler ou manipular arquivos fora da área permitida ao injetar '../' na entrada.

Example

Um sistema de download permite acesso a arquivos dentro de '/uploads/' passando o nome via parâmetro. Se o código faz `abrir('/uploads/' + nome_arquivo)` sem validar, um atacante passa `../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize caminhos usando funções de sistema (ex: `realpath()` em PHP/Linux, `Path.GetFullPath()` em .NET), rejeitando qualquer caminho que escape do diretório raiz permitido. Alternativa: use uma lista branca de nomes de arquivo ou mapeie entrada para IDs internos, nunca concatene entrada diretamente em caminhos.

CVE-2020-7377HIGHRapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump moduleEPSS 1.1%CVE-2025-1599MEDIUMSourceCodester Best Church Management Software profile_crud.php path traversalEPSS 1.1%CVE-2022-20913MEDIUMCisco Nexus Dashboard Arbitrary File Write VulnerabilityEPSS 1.1%CVE-2024-32115MEDIUMA relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged EPSS 1.1%CVE-2022-21808—Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions frEPSS 1.1%CVE-2023-50255CRITICALZip Path Traversal in Deepin-CompressorEPSS 1.1%CVE-2023-46119HIGHParse Server may crash when uploading file without extensionEPSS 1.1%CVE-2025-57403HIGHCola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the reEPSS 1.0%CVE-2024-9363HIGHUnauthorized File Deletion in polyaxon/polyaxonEPSS 1.0%CVE-2026-14903HIGHPath traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web rEPSS 1.0%CVE-2020-12010—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an aEPSS 1.0%CVE-2018-12476MEDIUMobs-service-extract_file's outfilename parameter allows to write files outside of package directoryEPSS 1.0%CVE-2026-61343HIGHLibreBooking path traversalEPSS 1.0%CVE-2022-36081HIGHWikmd vulnerable to Local File Enumeration when accessing /listEPSS 1.0%CVE-2023-40772MEDIUMA directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted requEPSS 1.0%CVE-2024-3025CRITICALPath Traversal in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-5547HIGHDirectory Traversal in stitionai/devikaEPSS 1.0%CVE-2026-16053HIGHPath TraversalEPSS 1.0%CVE-2026-4415CRITICALGIGABYTE｜Gigabyte Control Center - Arbitrary File WriteEPSS 1.0%CVE-2024-12482MEDIUMcjbi wetech-cms Database Backup BackupFileUtil.java backup path traversalEPSS 1.0%