Fallos del tipo CWE-22

6626 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2020-29495CRITICALDELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticatEPSS 6.4%CVE-2018-0426—Cisco RV110W, RV130W, and RV215W Routers Management Interface Directory Traversal VulnerabilityEPSS 6.4%CVE-2023-35844HIGHpackages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensEPSS 6.3%CVE-2024-45711HIGHSolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution VulnerabilityEPSS 6.3%CVE-2021-28588HIGHAdobe RoboHelp Server folderId Directory Traversal Remote Code Execution VulnerabilityEPSS 6.2%CVE-2017-16744—A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on MicrosEPSS 6.1%CVE-2025-67004MEDIUM** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directorieEPSS 6.1%CVE-2018-10870CRITICALredhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwritEPSS 6.1%CVE-2021-40661HIGHA remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing TerminEPSS 6.1%CVE-2024-31849CRITICALA path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which cEPSS 6.1%CVE-2024-33605HIGHImproper processing of some parameters of installed_emanual_list.html and installed_emanual_down.html leads to a path traversal vulnerabilitEPSS 6.0%CVE-2024-50322HIGHPath traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthentEPSS 6.0%CVE-2026-20180CRITICALCisco Identity Services Engine Multiple Remote Code Execution VulnerabilityEPSS 6.0%CVE-2026-38360CRITICALDirectory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code viaEPSS 6.0%CVE-2022-3782CRITICALkeycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirEPSS 6.0%CVE-2022-31062MEDIUMUnauthenticated Local File InclusionEPSS 5.9%CVE-2017-6636—A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticatedEPSS 5.9%CVE-2021-24644—Images to WebP < 1.9 - Authenticated Local File InclusionEPSS 5.9%CVE-2022-26500HIGHImproper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to inteEPSS 5.8%KEVCVE-2024-23479CRITICALSolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution VulnerabilityEPSS 5.8%