Weaknesses of type CWE-24

128 results

Travessia de Diretórios via Sequências de Escape

É quando uma aplicação não valida adequadamente caminhos de arquivo fornecidos pelo usuário, permitindo que sequências como '../' sejam usadas para acessar diretórios fora do escopo pretendido. Um atacante consegue ler, modificar ou deletar arquivos sensíveis do sistema usando apenas strings de navegação de diretórios.

Example

Uma aplicação web recebe uma requisição GET como /download?file=../../../etc/passwd sem validação. O servidor processa literalmente '../' e retorna arquivos do sistema operacional, expondo credenciais ou configurações críticas.

How to mitigate

Valide e normalize todos os caminhos de arquivo antes de processá-los (use função de canonização nativa da linguagem), mantenha arquivos sensíveis fora da raiz web acessível, e implemente listas de permissão (whitelist) de nomes de arquivo permitidos. Nunca confie em entrada do usuário para construir caminhos de arquivo.

CVE-2024-0341LOWInis GET Request File.php path traversalEPSS 0.6%CVE-2024-13130MEDIUMDahua IPC-HFW1200S Web Interface Sha1Account1 path traversalEPSS 0.6%CVE-2025-51661HIGHA path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use locaEPSS 0.6%CVE-2025-1584MEDIUMopensolon Solon StaticMappings.java path traversalEPSS 0.6%CVE-2026-118485HIGHAxel Download Accelerator Path Traversal via URL Filename DecodingEPSS 0.6%CVE-2024-6786MEDIUMMXview One Series vulnerable to Path TraversalEPSS 0.6%CVE-2026-21857HIGHRedaxo has Path Traversal in Backup Addon Leading to Arbitrary File ReadEPSS 0.5%CVE-2025-46094LOWLiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript.EPSS 0.5%CVE-2025-63298HIGHA path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php cEPSS 0.5%CVE-2025-67845MEDIUMA Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to injEPSS 0.5%CVE-2023-20098MEDIUMA vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vEPSS 0.5%CVE-2024-2564MEDIUMPandaXGO PandaX user.go ExportUser path traversalEPSS 0.5%CVE-2025-48050HIGHIn DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory.EPSS 0.5%CVE-2026-28427MEDIUMOpenDeck affected by path traversal allows arbitrary file readEPSS 0.5%CVE-2023-20167MEDIUMCisco Identity Services Engine Path Traversal VulnerabilitiesEPSS 0.5%CVE-2025-45582MEDIUMGNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victEPSS 0.5%CVE-2024-12897MEDIUMIntelbras VIP S4320 G2 Web Interface Sha1Account1 path traversalEPSS 0.5%CVE-2025-30343LOWA directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in foldersEPSS 0.5%CVE-2025-2961MEDIUMopensolon org.noear.solon.core.handle.RenderManager aa render_mav path traversalEPSS 0.5%CVE-2021-3710MEDIUMApport info disclosure via path traversal bug in read_fileEPSS 0.5%