Fallos del tipo CWE-22

5807 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2023-32167MEDIUMD-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion VulnerabilityEPSS 76.5%CVE-2015-0016HIGHDirectory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server EPSS 75.8%KEVCVE-2023-40496HIGHLG Simple Editor copyStickerContent Directory Traversal Information Disclosure VulnerabilityEPSS 75.7%CVE-2023-40495HIGHLG Simple Editor copyTemplateAll Directory Traversal Information Disclosure VulnerabilityEPSS 75.7%CVE-2024-55947HIGHGogs has a Path Traversal in file update APIEPSS 75.2%CVE-2014-0780CRITICALInduSoft Web Studio Path TraversalEPSS 74.4%KEVCVE-2023-32166HIGHD-Link D-View uploadFile Directory Traversal Arbitrary File Creation VulnerabilityEPSS 74.3%CVE-2021-27272HIGHThis vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System EPSS 73.8%CVE-2022-36982MEDIUMThis vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentEPSS 73.8%CVE-2021-27275HIGHThis vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAREPSS 73.3%CVE-2023-32165CRITICALD-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution VulnerabilityEPSS 73.3%CVE-2025-34508MEDIUMZendTo < 6.15-8 Path TraversalEPSS 73.2%CVE-2024-27954CRITICALWordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerabilityEPSS 72.8%CVE-2023-0126HIGHPre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitEPSS 72.7%CVE-2021-27276HIGHThis vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System EPSS 72.5%CVE-2023-32985MEDIUMJenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackeEPSS 72.4%CVE-2023-2825CRITICALAn issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulneEPSS 71.6%CVE-2023-38126HIGHSofting edgeAggregator Restore Configuration Directory Traversal Remote Code Execution VulnerabilityEPSS 71.2%CVE-2024-24992HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 70.9%CVE-2023-6893MEDIUMHikvision Intercom Broadcasting System exportrecord.php path traversalEPSS 70.2%