Fallos del tipo CWE-23

509 resultados

Travessia de diretório via normalização de caminho inadequada

A aplicação constrói caminhos de arquivo usando entrada do usuário sem neutralizar sequências como '..' (parent directory), permitindo acesso a arquivos fora do diretório restrito pretendido. Mesmo com validações parciais, um atacante consegue contorná-las usando variações de codificação ou normalização diferida.

Ejemplo

Um sistema de gerenciamento de documentos valida se o arquivo solicitado começa com '/uploads/', mas não normaliza '..' antes da validação. Requisição GET /document?file=/uploads/../../../etc/passwd permite ler /etc/passwd. O '..' é processado após a validação passar.

Cómo mitigar

Normalize o caminho completo (resolver symlinks, '..' e '.') ANTES de qualquer validação, depois verifique se o resultado está dentro do diretório permitido. Use APIs seguras da linguagem (realpath em C, Path.getCanonicalPath em Java, Path.resolve e comparação em Python) e sempre implemente validação com whitelist, não blacklist de caracteres.

CVE-2024-0335HIGHMalformed Packet HandlingEPSS 0.6%CVE-2026-59792CRITICALIn JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possibleEPSS 0.6%CVE-2025-44163MEDIUMRaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a craftEPSS 0.6%CVE-2024-9923MEDIUMTEAMPLUS TECHNOLOGY Team+ - Arbitrary File Move through Path TraversalEPSS 0.6%CVE-2026-48681MEDIUMOpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.EPSS 0.6%CVE-2024-54449HIGHRemote Code Execution (RCE) via Arbitrary File Write In Document APIEPSS 0.6%CVE-2026-25707HIGHHandcrafted repo metadata may cause arbitrary local files to be overwritten by libzyppEPSS 0.6%CVE-2026-80133HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path TravEPSS 0.6%CVE-2025-62552HIGHMicrosoft Access Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-6583MEDIUMPath Traversal in stangirard/quivrEPSS 0.6%CVE-2026-27489HIGHONNX: Path Traversal via SymlinkEPSS 0.6%CVE-2024-22096MEDIUMRelative Path Traversal in Rapid SCADAEPSS 0.6%CVE-2025-49466MEDIUMaerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachmentEPSS 0.6%CVE-2026-85199HIGHEclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiersEPSS 0.6%CVE-2024-49253HIGHWordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerabilityEPSS 0.6%CVE-2025-55013MEDIUMAssemblyline 4 Service Client: Arbitrary Write through path traversal in Client codeEPSS 0.6%CVE-2025-62878CRITICALLocal Path Provisioner vulnerable to Path Traversal via parameters.pathPatternEPSS 0.6%CVE-2026-66907HIGHApache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the resultEPSS 0.6%CVE-2025-22859MEDIUMA Relative Path Traversal vulnerability [CWE-23] in FortiClientEMS 7.4.0 through 7.4.1 and FortiClientEMS Cloud 7.4.0 through 7.4.1 may alloEPSS 0.6%CVE-2024-13130MEDIUMDahua IPC-HFW1200S Web Interface Sha1Account1 path traversalEPSS 0.6%