Fallos del tipo CWE-22

6629 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2021-23043—On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an uEPSS 2.0%CVE-2018-3729—localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to reEPSS 2.0%CVE-2017-12074—Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticEPSS 2.0%CVE-2025-34120HIGHLimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup PayloadEPSS 2.0%CVE-2022-0320—Essential Addons for Elementor < 5.0.5 - Unauthenticated LFIEPSS 2.0%CVE-2020-8214—A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file.EPSS 2.0%CVE-2023-5212CRITICALAI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_fileEPSS 2.0%CVE-2020-3241MEDIUMCisco UCS Director Path Traversal VulnerabilityEPSS 2.0%CVE-2019-18253—An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.1EPSS 2.0%CVE-2023-50785LOWZoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal.EPSS 2.0%CVE-2017-16170—liuyaserver is a static file server. liuyaserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem bEPSS 2.0%CVE-2017-16221—yzt is a simple file server. yzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" EPSS 2.0%CVE-2017-16173—utahcityfinder constructs lists of Utah cities with a certain prefix. utahcityfinder is vulnerable to a directory traversal issue, giving anEPSS 2.0%CVE-2017-16215—sgqserve is a simple file server. sgqserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placEPSS 2.0%CVE-2017-16193—mfrs is a static file server. mfrs is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../EPSS 2.0%CVE-2017-16039—`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16132—simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker accesEPSS 2.0%CVE-2017-16218—dgard8.lab6 is a static file server. dgard8.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem bEPSS 2.0%CVE-2017-16095—serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the fileEPSS 2.0%CVE-2017-16188—reecerver is a web server. reecerver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing ".EPSS 2.0%