Fallos del tipo CWE-22

6626 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2023-22629HIGHAn issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. AEPSS 12.3%CVE-2026-27825CRITICALMCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentEPSS 12.3%CVE-2019-9948CRITICALurllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechaniEPSS 11.8%CVE-2022-29799MEDIUMA vulnerability was found in networkd-dispatcher. This flaw exists because no functions are sanitized by the OperationalState or the AdminisEPSS 11.8%CVE-2023-26256HIGHAn unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By mEPSS 11.7%CVE-2025-53120CRITICALSecurden Unified PAM Path Traversal In File UploadEPSS 11.7%CVE-2024-8752CRITICALWebIQ 2.15.9 Runtime on Windows - Directory Traversal VulnerabilityEPSS 11.7%CVE-2022-3184CRITICALDataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated uEPSS 11.6%CVE-2018-1002200—plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) EPSS 11.6%CVE-2020-15639CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AuthentEPSS 11.5%CVE-2017-12263—A vulnerability in the web interface of Cisco License Manager software could allow an unauthenticated, remote attacker to download and view EPSS 11.5%CVE-2024-38878MEDIUMA vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), OmniviEPSS 11.5%CVE-2024-40422CRITICALThe snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An aEPSS 11.4%CVE-2022-1392—Videos sync PDF <= 1.7.4 - Unauthenticated LFIEPSS 11.3%CVE-2026-27483HIGHMindsDB has Path Traversal in /api/files Leading to Remote Code ExecutionEPSS 11.0%CVE-2022-41328MEDIUMA improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 thEPSS 10.7%KEVCVE-2025-2636HIGHInstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File InclusionEPSS 10.6%CVE-2025-4524CRITICALMadara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File InclusionEPSS 10.6%CVE-2018-1002203—unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot sEPSS 10.6%CVE-2018-1002201—zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip aEPSS 10.4%