Fallos del tipo CWE-22

6629 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2020-27859HIGHThis vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ESMPRO Manager 6.42. AuthenticEPSS 2.9%CVE-2025-32820HIGHA vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make anEPSS 2.9%CVE-2021-22651—When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot NEPSS 2.9%CVE-2024-23467CRITICALSolarWinds Access Rights Manager Directory Traversal Remote Code Execution VulnerabilityEPSS 2.9%CVE-2021-21904CRITICALA directory traversal vulnerability exists in the CMA CLI setenv command of Garrett Metal Detectors’ iC Module CMA Version 5.0. An attacker EPSS 2.9%CVE-2026-61560CRITICAL@zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeoverEPSS 2.9%CVE-2024-31851HIGHA path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which coulEPSS 2.9%CVE-2024-39903HIGHLocal File Inclusion in SolaraEPSS 2.9%CVE-2018-0405—Cisco RV180W Wireless-N Multifunction VPN Router Directory Path Traversal VulnerabilityEPSS 2.9%CVE-2023-40513MEDIUMLG Simple Editor UserManageController getImageByFilename Directory Traversal Information Disclosure VulnerabilityEPSS 2.9%CVE-2023-40514MEDIUMLG Simple Editor FileManagerController getImageByFilename Directory Traversal Information Disclosure VulnerabilityEPSS 2.9%CVE-2023-40512MEDIUMLG Simple Editor PlayerController getImageByFilename Directory Traversal Information Disclosure VulnerabilityEPSS 2.9%CVE-2025-30567HIGHWordPress WP01 plugin <= 2.6.2 - Arbitrary File Download VulnerabilityEPSS 2.9%CVE-2026-9282HIGHW3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' ParameterEPSS 2.9%CVE-2026-91136HIGHDivi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' ParameterEPSS 2.9%CVE-2021-27471HIGHRockwell Automation Connected Components Workbench Path TraversalEPSS 2.9%CVE-2023-40493CRITICALLG Simple Editor copySessionFolder Directory Traversal Remote Code Execution VulnerabilityEPSS 2.9%CVE-2024-24999HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 2.9%CVE-2022-23457HIGHPath Traversal in ESAPIEPSS 2.8%CVE-2020-37088HIGHSchool ERP Pro 1.0 - Arbitrary File ReadEPSS 2.8%