Fallos del tipo CWE-22

5839 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2024-45436CRITICALextractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.EPSS 2.6%CVE-2026-47932HIGHColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 2.5%CVE-2023-4613CRITICALUpload Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityEPSS 2.5%CVE-2022-21675CRITICALBytecode Viewer v2.10.x Zip SlipEPSS 2.5%CVE-2024-23466CRITICALSolarWinds Access Rights Manager Directory Traversal Remote Code Execution VulnerabilityEPSS 2.5%CVE-2018-1002207—mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to wrEPSS 2.5%CVE-2023-40517HIGHLG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure VulnerabilityEPSS 2.5%CVE-2020-14352—A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in reEPSS 2.5%CVE-2024-39786CRITICALMultiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially EPSS 2.5%CVE-2024-39787CRITICALMultiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially EPSS 2.5%CVE-2022-27657—A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient vEPSS 2.5%CVE-2017-6629—A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files iEPSS 2.5%CVE-2019-15600—A Path traversal exists in http_server which allows an attacker to read arbitrary system files.EPSS 2.5%CVE-2023-4614CRITICALsetThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityEPSS 2.5%CVE-2026-9290HIGHWP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query ParameterEPSS 2.5%CVE-2018-7503—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 2.5%CVE-2023-51639CRITICALAllegra downloadExportedChart Directory Traversal Authentication Bypass VulnerabilityEPSS 2.5%CVE-2022-29511CRITICALA directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1EPSS 2.5%CVE-2023-37460HIGHPlexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiverEPSS 2.5%CVE-2022-25249HIGHPTC Axeda agent and Axeda Desktop Server Path TraversalEPSS 2.5%