Fallos del tipo CWE-22

5866 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2020-2504MEDIUMAbsolute path traversal vulnerability in QESEPSS 1.0%CVE-2017-20145MEDIUMTecrail Responsive Filemanger path traversalEPSS 1.0%CVE-2026-14244HIGHJssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' ParameterEPSS 1.0%CVE-2026-42605HIGHAzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media UploadEPSS 1.0%CVE-2026-50869CRITICALAn issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted requestEPSS 1.0%CVE-2026-77086CRITICALSiYuan before v3.7.4 Path Traversal via packageNameEPSS 1.0%CVE-2026-32981HIGHRay Dashboard <= 2.8.0 Path Traversal Leading to Local File DisclosureEPSS 1.0%CVE-2024-32465HIGHGit's protections for cloning untrusted repositories can be bypassedEPSS 1.0%CVE-2026-49970HIGHLaravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()EPSS 1.0%CVE-2026-80155CRITICALLantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path TruncationEPSS 1.0%CVE-2022-42977HIGHThe Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, andEPSS 1.0%CVE-2024-7777CRITICALContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And DeletionEPSS 1.0%CVE-2024-10625CRITICALWooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File DeletionEPSS 1.0%CVE-2024-37037HIGHCWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticateEPSS 1.0%CVE-2024-7149HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File InclusionEPSS 1.0%CVE-2019-25097MEDIUMsoerennb eXtplorer Directory Content path traversalEPSS 1.0%CVE-2024-4315CRITICALLFI Vulnerability due to Lack of Path Sanitization in parisneo/lollmsEPSS 1.0%CVE-2026-49163HIGHApplication Insights Profiler Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2024-12830HIGHArista NG Firewall custom_handler Directory Traversal Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-5414CRITICALIcegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File ReadEPSS 1.0%