Fallos del tipo CWE-22

6629 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2023-5241CRITICALAI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_fileEPSS 2.6%CVE-2022-2969HIGHICSA-22-307-03 Delta Industrial Automation DIALink Path traversalEPSS 2.5%CVE-2023-4613CRITICALUpload Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityEPSS 2.5%CVE-2024-23466CRITICALSolarWinds Access Rights Manager Directory Traversal Remote Code Execution VulnerabilityEPSS 2.5%CVE-2011-10010CRITICALQuickShare File Server 1.2.1 Path Traversal RCEEPSS 2.5%CVE-2018-1002207—mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to wrEPSS 2.5%CVE-2023-40517HIGHLG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure VulnerabilityEPSS 2.5%CVE-2020-14352—A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in reEPSS 2.5%CVE-2026-25592CRITICALSemantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDKEPSS 2.5%CVE-2017-6629—A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files iEPSS 2.5%CVE-2022-27657—A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient vEPSS 2.5%CVE-2019-15600—A Path traversal exists in http_server which allows an attacker to read arbitrary system files.EPSS 2.5%CVE-2023-4614CRITICALsetThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityEPSS 2.5%CVE-2026-9290HIGHWP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query ParameterEPSS 2.5%CVE-2023-51639CRITICALAllegra downloadExportedChart Directory Traversal Authentication Bypass VulnerabilityEPSS 2.5%CVE-2023-37460HIGHPlexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiverEPSS 2.5%CVE-2023-42129MEDIUMA10 Thunder ADC ShowTechDownloadView Directory Traversal Information Disclosure VulnerabilityEPSS 2.5%CVE-2021-21894CRITICALA directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specEPSS 2.5%CVE-2023-40055HIGHSolarWinds Network Configuration Manager Directory Traversal Remote Code Execution VulnerabilityEPSS 2.5%CVE-2022-25249HIGHPTC Axeda agent and Axeda Desktop Server Path TraversalEPSS 2.5%