Fallos del tipo CWE-22

5950 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2026-84421HIGHDataStage on Cloud Pak for Data has several vulnerabilitiesEPSS 0.6%CVE-2024-33535HIGHAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) inEPSS 0.6%CVE-2025-22663HIGHWordPress Paid Videochat Turnkey Site plugin <= 7.2.12 - Arbitrary File Deletion vulnerabilityEPSS 0.6%CVE-2023-25303HIGHATLauncher <= 3.4.26.0 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of tEPSS 0.6%CVE-2026-56122HIGHWinstone Servlet Engine 0.9.10 Path Traversal via HTTP Request PathsEPSS 0.6%CVE-2024-39619CRITICALWordPress ListingPro plugin <= 2.9.4 - Unauthenticated Local File Inclusion vulnerabilityEPSS 0.6%CVE-2026-59733HIGHrclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositoriesEPSS 0.6%CVE-2026-22448HIGHWordPress PitchPrint plugin <= 11.1.2 - Arbitrary File Deletion vulnerabilityEPSS 0.6%CVE-2026-41552CRITICALPath Traversal in PDF Export ModuleEPSS 0.6%CVE-2025-9693HIGHUser Meta – User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.6%CVE-2026-33242HIGHSalvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway BypassEPSS 0.6%CVE-2026-65886CRITICALJoomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2EPSS 0.6%CVE-2026-15786MEDIUMWP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' ParameterEPSS 0.6%CVE-2025-65345MEDIUMalexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to cEPSS 0.6%CVE-2025-1565HIGHMayosis Core <= 5.4.1 - Unauthenticated Arbitrary File ReadEPSS 0.6%CVE-2024-43271HIGHWordPress Widgets for WooCommerce Products on Elementor plugin <= 2.0.0 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2025-32926CRITICALWordPress Grand Restaurant WordPress theme <= 7.0 - Path Traversal to PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-34712MEDIUMOceanic allows unsanitized user input to lead to path traversal in URLsEPSS 0.6%CVE-2024-45842MEDIUMSharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internaEPSS 0.6%CVE-2024-8304MEDIUMjpress Template Module edit path traversalEPSS 0.6%