Fallos del tipo CWE-22

5865 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2024-44373CRITICALA Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.06_06 allows an unauthenticated attacker to create a webshell and remoEPSS 1.2%CVE-2026-17604MEDIUMKirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' ParameterEPSS 1.2%CVE-2022-4779HIGHauthentication bypass in elvexys StreamX using StreamView HTML component with public web server featureEPSS 1.2%CVE-2026-12701CRITICALPulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportEPSS 1.2%CVE-2022-46309MEDIUMGalaxy Software Services Corporation. Vitals ESP - Arbitrary Path File ReadingEPSS 1.2%CVE-2021-39208MEDIUMWriteEntryToDirectory used for an archive extraction is vulnerable to partial path traversal.EPSS 1.2%CVE-2023-24836HIGHSUNNET CTMS - Path TraversalEPSS 1.2%CVE-2025-54802CRITICALpyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)EPSS 1.2%CVE-2024-22851HIGHDirectory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted requesEPSS 1.2%CVE-2025-30387CRITICALDocument Intelligence Studio On-Prem Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2025-54755MEDIUMBIG-IP Configuration utility vulnerabilityEPSS 1.2%CVE-2024-27318HIGHVersions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor protEPSS 1.2%CVE-2023-46749MEDIUMApache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting EPSS 1.2%CVE-2026-7252HIGHWP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post MetaEPSS 1.2%CVE-2022-24877CRITICALImproper path handling in kustomization files allows path traversalEPSS 1.2%CVE-2023-24455MEDIUMJenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackersEPSS 1.2%CVE-2022-45969CRITICALAlist v3.4.0 is vulnerable to Directory Traversal,EPSS 1.2%CVE-2023-28406MEDIUMBIG-IP Configuration utility vulnerabilityEPSS 1.2%CVE-2025-5328MEDIUMchshcms mccms Backups.php restore_del path traversalEPSS 1.2%CVE-2023-5245HIGHUsing MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution.EPSS 1.2%