Fallos del tipo CWE-22

5868 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2026-37007CRITICALA vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversEPSS 1.0%CVE-2026-2743CRITICALSEPPmail User Web Interface Arbitrary File Write to RCEEPSS 1.0%CVE-2023-30620HIGHArbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdbEPSS 1.0%CVE-2025-69820MEDIUMDirectory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath funEPSS 1.0%CVE-2023-46886CRITICALDreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the tEPSS 1.0%CVE-2023-40160LOWDirectory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 producEPSS 1.0%CVE-2016-10538—The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting userEPSS 1.0%CVE-2026-2953MEDIUMDromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversalEPSS 1.0%CVE-2026-25770CRITICALWazuh has Privilege Escalation to Root via Cluster Protocol File WriteEPSS 1.0%CVE-2022-43858MEDIUMIBM Navigator for i information disclosureEPSS 1.0%CVE-2023-38695MEDIUMcypress-image-snapshot vulnerable to insecure snapshot file namesEPSS 1.0%CVE-2024-40550HIGHAn arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers tEPSS 1.0%CVE-2023-31483HIGHtar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.17 has a directory traversal during extraction that allows the attacker to createEPSS 1.0%CVE-2024-50649CRITICALThe user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.EPSS 1.0%CVE-2022-43857MEDIUMIBM Navigator for i information disclosureEPSS 1.0%CVE-2026-48055CRITICALStreambert: Arbitrary File Write (Zip Slip) via Subtitle ExtractionEPSS 1.0%CVE-2024-25711HIGHdiffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may bEPSS 1.0%CVE-2022-25848HIGHDirectory TraversalEPSS 1.0%CVE-2026-35718MEDIUMA path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attaEPSS 1.0%CVE-2024-33274HIGHDirectory Traversal vulnerability in FME Modules customfields v.2.2.7 and before allows a remote attacker to obtain sensitive information viEPSS 1.0%