Fallos del tipo CWE-22

6626 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2024-11238MEDIUMLandray EKP sysUiComponent.do delPreviewFile path traversalEPSS 5.7%CVE-2022-41840HIGHWordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerabilityEPSS 5.7%CVE-2026-73034CRITICALDB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id HeaderEPSS 5.7%CVE-2025-46704MEDIUMAdvantech iView Path TraversalEPSS 5.7%CVE-2024-45256CRITICALAn arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite databaseEPSS 5.6%CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.6%CVE-2023-31059HIGHRepetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLosEPSS 5.6%CVE-2026-2493HIGHIceWarp collaboration Directory Traversal Information Disclosure VulnerabilityEPSS 5.5%CVE-2018-1002209—QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip EPSS 5.5%CVE-2022-25371—Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizEPSS 5.4%CVE-2025-34452HIGHStreama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File WriteEPSS 5.4%CVE-2017-10940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsEPSS 5.4%CVE-2018-0464—Cisco Data Center Network Manager Path Traversal VulnerabilityEPSS 5.4%CVE-2020-8159—There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentialEPSS 5.4%CVE-2021-21090HIGHAdobe InCopy DOCX file parsing directory traversal vulnerability could lead to remote code executionEPSS 5.4%CVE-2019-16765HIGHIf an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension actEPSS 5.4%CVE-2020-12003—FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContEPSS 5.4%CVE-2021-21514MEDIUMDell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privEPSS 5.4%CVE-2018-11455—A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6EPSS 5.2%CVE-2021-25082—Popup Builder < 4.0.7 - LFI to RCEEPSS 5.2%