Weaknesses of type CWE-35

184 results

Bypass de restrição de diretório com sequências de caminho duplicadas

O software tenta restringir o acesso a um diretório específico, mas falha em neutralizar sequências como '.../...//' (barras e pontos duplicados) que conseguem 'escapar' para fora do diretório permitido. Um atacante fornece uma entrada malformada que, depois de processada, aponta para arquivos fora da zona de segurança pretendida.

Example

Um sistema de galeria de fotos só deveria servir imagens de '/uploads/'. Um usuário malicioso solicita '/uploads/.../...//../../../etc/passwd' esperando que o parser de caminhos normalize incorretamente e acesse um arquivo sensível fora da restrição.

How to mitigate

Valide e normalize completamente o caminho fornecido ANTES de qualquer verificação (use funções nativas como `realpath()` em PHP ou `Path.resolve()` em Node.js), depois confirme que o resultado está dentro do diretório permitido. Rejeite entrada com sequências suspeitas ('..', '//', '...') logo na entrada.

CVE-2023-5885MEDIUMFranklin Electric Fueling Systems Colibri Path TraversalEPSS 1.1%CVE-2024-0113HIGHNVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traverEPSS 1.1%CVE-2025-26352MEDIUMA CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated EPSS 1.1%CVE-2025-59793CRITICALRocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be ableEPSS 1.1%CVE-2025-64676HIGHMicrosoft Purview eDiscovery Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-21575CRITICALComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST requestEPSS 1.0%CVE-2026-45495HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-26355MEDIUMA CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticateEPSS 0.9%CVE-2023-6252HIGHPath traversal vulnerability in Chameleon Power productsEPSS 0.9%CVE-2025-32585HIGHWordPress Shop Products Filter Plugin <= 1.2 - Local File Inclusion vulnerabilityEPSS 0.9%CVE-2024-2654MEDIUMFile Manager <= 7.2.5 - Authenticated (Administrator+) Directory TraversalEPSS 0.9%CVE-2026-24464MEDIUMAppliance mode iControl REST vulnerabilityEPSS 0.9%CVE-2025-26353MEDIUMA CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote aEPSS 0.9%CVE-2025-26351MEDIUMA CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated EPSS 0.9%CVE-2024-45190MEDIUMMage AI pipeline interaction request remote arbitrary file leakEPSS 0.9%CVE-2022-2265HIGHPath traversal in Identity and Directory Management SystemEPSS 0.9%CVE-2025-26354HIGHA CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allowsEPSS 0.8%CVE-2025-26356HIGHA CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 aEPSS 0.8%CVE-2025-59099HIGHUnauthenticated Path Traversal in dormakaba access managerEPSS 0.8%CVE-2024-1886LOWAbsolute path traversal attack on LG SignageEPSS 0.8%