Fallos del tipo CWE-22

6629 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2019-16777HIGHArbitrary File Overwrite in npm CLIEPSS 2.0%CVE-2025-25163HIGHWordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerabilityEPSS 2.0%CVE-2025-67254HIGHNagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.EPSS 2.0%CVE-2018-3787—Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.EPSS 2.0%CVE-2011-10009HIGHS40 CMS 0.4.2 Path TraversalEPSS 2.0%CVE-2021-48014CRITICALFineReport 9.0 Unauthenticated Path Traversal File Write via ReportServerEPSS 2.0%CVE-2024-24398CRITICALDirectory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitraryEPSS 2.0%CVE-2023-28413CRITICALDirectory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitEPSS 2.0%CVE-2022-43864HIGHIBM Business Automation Workflow information disclosureEPSS 2.0%CVE-2024-48510CRITICALDirectory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.SharedEPSS 2.0%CVE-2024-7603HIGHLogsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion VulnerabilityEPSS 2.0%CVE-2024-7600HIGHLogsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion VulnerabilityEPSS 2.0%CVE-2024-11664HIGHeNMS TGZ File controller.py multiselect_filtering path traversalEPSS 2.0%CVE-2022-48483HIGH3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/dowEPSS 2.0%CVE-2018-3725—hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read conteEPSS 2.0%CVE-2018-3731—public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read EPSS 2.0%CVE-2018-3727—626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read contentEPSS 2.0%CVE-2026-18051CRITICALW3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache KeyEPSS 2.0%CVE-2018-3730—mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to reaEPSS 2.0%CVE-2025-27222HIGHTRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesnEPSS 2.0%