Fallos del tipo CWE-23

509 resultados

Travessia de diretório via normalização de caminho inadequada

A aplicação constrói caminhos de arquivo usando entrada do usuário sem neutralizar sequências como '..' (parent directory), permitindo acesso a arquivos fora do diretório restrito pretendido. Mesmo com validações parciais, um atacante consegue contorná-las usando variações de codificação ou normalização diferida.

Ejemplo

Um sistema de gerenciamento de documentos valida se o arquivo solicitado começa com '/uploads/', mas não normaliza '..' antes da validação. Requisição GET /document?file=/uploads/../../../etc/passwd permite ler /etc/passwd. O '..' é processado após a validação passar.

Cómo mitigar

Normalize o caminho completo (resolver symlinks, '..' e '.') ANTES de qualquer validação, depois verifique se o resultado está dentro do diretório permitido. Use APIs seguras da linguagem (realpath em C, Path.getCanonicalPath em Java, Path.resolve e comparação em Python) e sempre implemente validação com whitelist, não blacklist de caracteres.

CVE-2025-62498HIGHAutomationDirect Productivity Suite Relative Path TraversalEPSS 0.5%CVE-2026-8387LOWRelative Path Traversal in allegroai/clearmlEPSS 0.5%CVE-2025-13161HIGHIQ Service International｜IQ-Support - Arbitrary File ReadEPSS 0.5%CVE-2024-47856CRITICALIn RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or morEPSS 0.5%CVE-2026-27202HIGHGetSimple CMS: Uploaded Files (feature) Arbitrary File Read VulnerabilityEPSS 0.5%CVE-2024-47948MEDIUMIn JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backupsEPSS 0.5%CVE-2026-44941HIGHlibzypp path traversal via "keyhint" in repomd.xmlEPSS 0.5%CVE-2023-35816LOWDevExpress before 23.1.3 allows arbitrary TypeConverter conversion.EPSS 0.5%CVE-2025-24343MEDIUMA vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) atEPSS 0.5%CVE-2024-46664MEDIUMA relative path traversal in Fortinet FortiRecorder [CWE-23] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to reEPSS 0.5%CVE-2026-66906CRITICALApache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDirEPSS 0.5%CVE-2025-15225HIGHSunnet｜WMPro - Arbitrary File ReadEPSS 0.5%CVE-2026-50016HIGHpnpm: Transitive dependency alias path traversal allows project path override via symlink replacementEPSS 0.5%CVE-2025-48977HIGHApache Ignite: REST HTTP arbitrary file read vulnerabilityEPSS 0.5%CVE-2023-30630HIGHDmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode viEPSS 0.5%CVE-2025-9570MEDIUMSunnet｜eHRD CTMS - Arbitrary File Reading through Path TraversalEPSS 0.5%CVE-2026-33494CRITICALOry Oathkeeper has a path traversal authorization bypassEPSS 0.5%CVE-2026-29778HIGHpyLoad: Arbitrary File Write via Path Traversal in edit_package()EPSS 0.5%CVE-2025-23360HIGHNVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successfuEPSS 0.5%CVE-2023-0745MEDIUMArbitrary File Write in High Availability Backup UploadEPSS 0.5%