Weaknesses of type CWE-36

144 results

Travessia de diretório via caminho absoluto

A aplicação constrói caminhos de arquivo usando entrada externa, mas não valida adequadamente caminhos absolutos (como /etc/passwd ou C:\Windows\System32). Um atacante pode fornecer um caminho completo que ignora completamente a restrição de diretório pretendida, acessando arquivos fora da pasta permitida.

Example

Um serviço web que baixa arquivos do diretório /uploads/user123/ recebe a entrada do usuário para nome do arquivo. Se o usuário envia '/etc/passwd' em vez de apenas 'documento.pdf', o sistema tenta ler /etc/passwd, não /uploads/user123/etc/passwd, expondo dados sensíveis.

How to mitigate

Valide e normalize toda entrada de caminho (remova .., barras iniciais, e sequências de escape), use uma lista de permissão de caracteres seguros, e canonicalize o caminho final antes de acessar o arquivo para garantir que está realmente dentro do diretório esperado. Alternativa robusta: use IDs ou índices em vez de nomes de arquivo fornecidos pelo usuário.

CVE-2024-20401CRITICALA vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote EPSS 2.3%CVE-2023-2765MEDIUMWeaver OA downfile.php absolute path traversalEPSS 2.2%CVE-2024-6250HIGHAbsolute Path Traversal in parisneo/lollms-webuiEPSS 1.9%CVE-2025-53392MEDIUMIn Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directEPSS 1.8%CVE-2024-47883CRITICALButterfly has path/URL confusion in resource handling leading to multiple weaknessesEPSS 1.6%CVE-2023-34135—Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlyiEPSS 1.6%CVE-2017-7929—An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has EPSS 1.5%CVE-2021-1617MEDIUMCisco Intersight Virtual Appliance VulnerabilitiesEPSS 1.5%CVE-2022-20791MEDIUMCisco Unified Communications Products Arbitrary File Read VulnerabilityEPSS 1.5%CVE-2022-1554MEDIUMPath Traversal due to `send_file` call in clinical-genomics/scoutEPSS 1.4%CVE-2021-32507MEDIUMQSAN Storage Manager - Absolute Path Traversal via FileDownload functionEPSS 1.3%CVE-2021-32506MEDIUMQSAN Storage Manager - Absolute Path Traversal via GetImage functionEPSS 1.3%CVE-2021-30173MEDIUMJun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File InclusionEPSS 1.2%CVE-2022-24877CRITICALImproper path handling in kustomization files allows path traversalEPSS 1.2%CVE-2024-2362CRITICALPath Traversal in parisneo/lollms-webuiEPSS 1.1%CVE-2022-20958HIGHA vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacEPSS 1.0%CVE-2023-5115MEDIUMAnsible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesEPSS 1.0%CVE-2024-10047MEDIUMDirectory Listing Vulnerability in parisneo/lollms-webuiEPSS 1.0%CVE-2024-8501HIGHArbitrary File Download in modelscope/agentscopeEPSS 1.0%CVE-2025-4799HIGHWP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File DeletionEPSS 0.9%