Fallos del tipo CWE-22

5807 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2024-9047CRITICALWordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.phpEPSS 93.3%CVE-2024-7399HIGHImproper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackEPSS 91.9%KEVCVE-2022-37042CRITICALZimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypaEPSS 91.9%KEVCVE-2020-27871HIGHThis vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. AlthouEPSS 90.8%CVE-2025-6218HIGHRARLAB WinRAR Directory Traversal Remote Code Execution VulnerabilityEPSS 90.5%KEVCVE-2021-20123HIGHA local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet eEPSS 90.2%KEVCVE-2019-7195CRITICALThis external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,EPSS 89.7%KEVCVE-2024-37032HIGHOllama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandlesEPSS 89.6%CVE-2022-24716HIGHPath traversal in Icinga Web 2EPSS 89.4%CVE-2021-43798HIGHGrafana path traversalEPSS 88.5%KEVCVE-2024-36104CRITICALApache OFBiz: Path traversal leading to a RCEEPSS 87.8%CVE-2022-31706CRITICALThe vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operatiEPSS 87.1%CVE-2020-11652MEDIUMAn issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to EPSS 86.2%KEVCVE-2024-1728HIGHLocal File Inclusion in gradio-app/gradioEPSS 85.4%CVE-2019-3799—Directory Traversal with spring-cloud-config-serverEPSS 85.3%CVE-2023-40498CRITICALLG Simple Editor cp Command Directory Traversal Remote Code Execution VulnerabilityEPSS 85.1%CVE-2023-32164HIGHD-Link D-View TftpSendFileThread Directory Traversal Information Disclosure VulnerabilityEPSS 84.9%CVE-2023-41266HIGHA path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 aEPSS 84.8%KEVCVE-2023-38950HIGHA path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplEPSS 84.7%KEVCVE-2015-3035HIGHDirectory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0)EPSS 83.9%KEV