Fallos del tipo CWE-22

5865 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2023-43216—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.EPSS 1.2%CVE-2023-44169—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php.EPSS 1.2%CVE-2023-32756HIGHe-Excellence U-Office Force - Path TraversalEPSS 1.2%CVE-2023-44171—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php.EPSS 1.2%CVE-2023-44172—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php.EPSS 1.2%CVE-2023-44170—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php.EPSS 1.2%CVE-2026-1523HIGHPath Traversal in Digitek from Grupo AzkoyenEPSS 1.2%CVE-2026-16585HIGHBetter Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' ParameterEPSS 1.2%CVE-2026-17524HIGHVersions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the EPSS 1.2%CVE-2024-10011HIGHBuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory TraversalEPSS 1.2%CVE-2026-3838HIGHUnraid Update Request Path Traversal Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-72571HIGHmustafaakin cast-localvideo - Unauthenticated Path Traversal via dir ParameterEPSS 1.1%CVE-2026-72572HIGHo1lab xmysql - Unauthenticated Path Traversal via name Query ParameterEPSS 1.1%CVE-2022-47768HIGHSerenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.EPSS 1.1%CVE-2026-15244HIGHHUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_viewEPSS 1.1%CVE-2023-34407HIGHOfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL.EPSS 1.1%CVE-2023-35185MEDIUMSolarWinds Access Rights Manager OpenFile Directory Traversal Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-11429CRITICALPath Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code ExecutionEPSS 1.1%CVE-2026-89040CRITICALTencent Mass Service Engine in Cluster (MSEC) path traversalEPSS 1.1%CVE-2023-23946MEDIUMGit's `git apply` overwriting paths outside the working treeEPSS 1.1%