Weaknesses of type CWE-35

184 results

Bypass de restrição de diretório com sequências de caminho duplicadas

O software tenta restringir o acesso a um diretório específico, mas falha em neutralizar sequências como '.../...//' (barras e pontos duplicados) que conseguem 'escapar' para fora do diretório permitido. Um atacante fornece uma entrada malformada que, depois de processada, aponta para arquivos fora da zona de segurança pretendida.

Example

Um sistema de galeria de fotos só deveria servir imagens de '/uploads/'. Um usuário malicioso solicita '/uploads/.../...//../../../etc/passwd' esperando que o parser de caminhos normalize incorretamente e acesse um arquivo sensível fora da restrição.

How to mitigate

Valide e normalize completamente o caminho fornecido ANTES de qualquer verificação (use funções nativas como `realpath()` em PHP ou `Path.resolve()` em Node.js), depois confirme que o resultado está dentro do diretório permitido. Rejeite entrada com sequências suspeitas ('..', '//', '...') logo na entrada.

CVE-2022-3693HIGHPath traversal in FileOrbis File Management SystemEPSS 0.7%CVE-2025-47636HIGHWordPress List category posts plugin <= 0.91.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2025-39598MEDIUMWordPress Administrator Z plugin <= 2025.03.28 - Directory Traversal VulnerabilityEPSS 0.7%CVE-2025-22786HIGHWordPress ElementInvader Addons for Elementor plugin <= 1.2.6 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2023-5800MEDIUMInsufficient input validation in VAPIX API create_overlay.cgiEPSS 0.7%CVE-2025-39470HIGHWordPress Ivy School theme <= 1.6.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2024-56045CRITICALWordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerabilityEPSS 0.7%CVE-2023-21418HIGHSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks EPSS 0.7%CVE-2023-21417HIGHSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversaEPSS 0.7%CVE-2023-21416HIGHSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-ServicEPSS 0.7%CVE-2025-26935HIGHWordPress WP Job Portal plugin <= 2.2.8 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2025-24685HIGHWordPress Morkva UA Shipping plugin <= 1.0.18 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2026-45661CRITICALDokploy: Remote Code Execution through Path TraversalEPSS 0.7%CVE-2025-39475HIGHWordPress Arlo theme <= 6.0.3 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2023-39916CRITICALPossible path traversal when storing RRDP responsesEPSS 0.6%CVE-2024-52498HIGHWordPress SP Blog Designer plugin <= 1.0.0 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2024-41973HIGHWAGO: Remote Arbitrary File Write with Root Privileges in multiple DevicesEPSS 0.6%CVE-2024-52447HIGHWordPress Contact Page With Google Map plugin <= 1.6.1 - Arbitrary File Deletion vulnerabilityEPSS 0.6%CVE-2025-49297HIGHWordPress Grill and Chow theme <= 1.6 - Local File Inclusion VulnerabilityEPSS 0.6%CVE-2025-49295HIGHWordPress MediClinic theme <= 2.1 - Local File Inclusion VulnerabilityEPSS 0.6%