Fallos del tipo CWE-22

5865 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2023-30626HIGHJellyfin vulnerable to directory traversal and file write causing arbitrary code executionEPSS 2.0%CVE-2017-15895—Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authentEPSS 2.0%CVE-2022-43864HIGHIBM Business Automation Workflow information disclosureEPSS 2.0%CVE-2019-10242—In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversEPSS 2.0%CVE-2021-1259MEDIUMCisco SD-WAN vManage Software Path Traversal VulnerabilityEPSS 1.9%CVE-2024-31818CRITICALDirectory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.pEPSS 1.9%CVE-2021-33178—The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. EPSS 1.9%CVE-2017-9270HIGHpost-auth arbitrary file write on cryptctl serverEPSS 1.9%CVE-2025-34110CRITICALColoradoFTP Server <= 1.3 Build 8 Path Traversal Information DisclosureEPSS 1.9%CVE-2023-22273HIGHZDI-CAN-21307: Adobe RoboHelp Server OnPublishFile Directory Traversal Remote Code Execution VulnerabilityEPSS 1.9%CVE-2023-35840MEDIUM_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.EPSS 1.9%CVE-2014-10068—The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden`EPSS 1.9%CVE-2022-23612HIGHDirectory Traversal in OpenMRS Startup FilterEPSS 1.9%CVE-2023-52334HIGHAllegra downloadAttachmentGlobal Directory Traversal Information Disclosure VulnerabilityEPSS 1.9%CVE-2023-51648HIGHAllegra getFileContentAsString Directory Traversal Information Disclosure VulnerabilityEPSS 1.9%CVE-2026-71209HIGHaudiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path TraversalEPSS 1.9%CVE-2018-3734—stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read conEPSS 1.9%CVE-2018-3766—Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server.EPSS 1.9%CVE-2012-10034HIGHClanSphere 2011.3 Local File Inclusion via cs_lang CookieEPSS 1.9%CVE-2023-52333CRITICALAllegra saveFile Directory Traversal Remote Code Execution VulnerabilityEPSS 1.9%