Weaknesses of type CWE-36

144 results

Travessia de diretório via caminho absoluto

A aplicação constrói caminhos de arquivo usando entrada externa, mas não valida adequadamente caminhos absolutos (como /etc/passwd ou C:\Windows\System32). Um atacante pode fornecer um caminho completo que ignora completamente a restrição de diretório pretendida, acessando arquivos fora da pasta permitida.

Example

Um serviço web que baixa arquivos do diretório /uploads/user123/ recebe a entrada do usuário para nome do arquivo. Se o usuário envia '/etc/passwd' em vez de apenas 'documento.pdf', o sistema tenta ler /etc/passwd, não /uploads/user123/etc/passwd, expondo dados sensíveis.

How to mitigate

Valide e normalize toda entrada de caminho (remova .., barras iniciais, e sequências de escape), use uma lista de permissão de caracteres seguros, e canonicalize o caminho final antes de acessar o arquivo para garantir que está realmente dentro do diretório esperado. Alternativa robusta: use IDs ou índices em vez de nomes de arquivo fornecidos pelo usuário.

CVE-2025-36574HIGHDell Wyse Management Suite, versions prior to WMS 5.2, contain an Absolute Path Traversal vulnerability. An unauthenticated attacker with reEPSS 0.5%CVE-2025-14253MEDIUMGalaxy Software Services｜Vitals ESP - Arbitrary File ReadEPSS 0.5%CVE-2026-4782MEDIUMAvada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode ParameterEPSS 0.5%CVE-2024-48850HIGHAuthenticated Absolute Path TraversalEPSS 0.5%CVE-2025-53079MEDIUMAbsolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive filesEPSS 0.5%CVE-2026-2753HIGHAn Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize usEPSS 0.5%CVE-2026-61891HIGHIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GEEPSS 0.5%CVE-2026-58300MEDIUMMicrosoft Edge for Android Information Disclosure VulnerabilityEPSS 0.4%CVE-2025-53651MEDIUMJenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTMEPSS 0.4%CVE-2026-7217MEDIUMDeepractice PromptX Document File index.ts read_pdf absolute path traversalEPSS 0.4%CVE-2026-35465HIGHSecureDrop Client has path injection in read_gzip_header_filename()EPSS 0.4%CVE-2026-34515MEDIUMAIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on WindowsEPSS 0.4%CVE-2025-9516MEDIUMatec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File ReadEPSS 0.4%CVE-2026-0846HIGHArbitrary File Read via Absolute Path Input in nltk.util.filestring()EPSS 0.4%CVE-2024-13945HIGHStored Absolute Path TraversalEPSS 0.4%CVE-2026-68487CRITICALPath traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.EPSS 0.4%CVE-2026-4373HIGHJetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media FieldEPSS 0.4%CVE-2026-42315HIGHpyLoad: Path Traversal via Package Folder Name in set_package_dataEPSS 0.4%CVE-2026-10075MEDIUMInterinfo｜DreamMaker - Path TraversalEPSS 0.4%CVE-2026-88288MEDIUMGV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink CreationEPSS 0.4%