Fallos del tipo CWE-22

5865 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2023-6577MEDIUMByzoro PatrolFlow 2530Pro mailsendview.php path traversalEPSS 1.2%CVE-2021-41294CRITICALECOA BAS controller - Path Traversal-4EPSS 1.2%CVE-2022-27615HIGHImproper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before EPSS 1.2%CVE-2024-7564MEDIUMLogsign Unified SecOps Platform Directory Traversal Information Disclosure VulnerabilityEPSS 1.2%CVE-2023-40297HIGHStakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component.EPSS 1.2%CVE-2024-52291HIGHCraft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code ExecutionEPSS 1.2%CVE-2024-11771MEDIUMPath traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality.EPSS 1.2%CVE-2025-37095MEDIUMA directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2026-33001HIGHJenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,EPSS 1.2%CVE-2025-27413MEDIUMPwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.jsonEPSS 1.2%CVE-2024-5187HIGHArbitrary File Overwrite in download_model_with_test_data in onnx/onnxEPSS 1.2%CVE-2026-11911HIGHSimple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' ParameterEPSS 1.2%CVE-2021-40359HIGHA vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versionEPSS 1.2%CVE-2022-45093HIGHA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the WebEPSS 1.2%CVE-2022-33165MEDIUMIBM Security Directory Server information disclosureEPSS 1.2%CVE-2022-34126HIGHThe Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter.EPSS 1.2%CVE-2023-38702CRITICALKnowage Server vulnerable to path traversal via upload functionalityEPSS 1.2%CVE-2020-15182HIGHCross-site Request Forgery leading to RCE in SOY CMSEPSS 1.2%CVE-2023-32003MEDIUM`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from EPSS 1.2%CVE-2023-25265HIGHDocmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the file system.EPSS 1.2%