Fallos del tipo CWE-23

509 resultados

Travessia de diretório via normalização de caminho inadequada

A aplicação constrói caminhos de arquivo usando entrada do usuário sem neutralizar sequências como '..' (parent directory), permitindo acesso a arquivos fora do diretório restrito pretendido. Mesmo com validações parciais, um atacante consegue contorná-las usando variações de codificação ou normalização diferida.

Ejemplo

Um sistema de gerenciamento de documentos valida se o arquivo solicitado começa com '/uploads/', mas não normaliza '..' antes da validação. Requisição GET /document?file=/uploads/../../../etc/passwd permite ler /etc/passwd. O '..' é processado após a validação passar.

Cómo mitigar

Normalize o caminho completo (resolver symlinks, '..' e '.') ANTES de qualquer validação, depois verifique se o resultado está dentro do diretório permitido. Use APIs seguras da linguagem (realpath em C, Path.getCanonicalPath em Java, Path.resolve e comparação em Python) e sempre implemente validação com whitelist, não blacklist de caracteres.

CVE-2025-13771HIGHUniong｜WebITR - Arbitrary File ReadEPSS 0.5%CVE-2026-29101MEDIUMSuiteCRM Vulnerable to Directory Traversal to DoS in ModulesEPSS 0.5%CVE-2025-51052MEDIUMA path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting EPSS 0.4%CVE-2026-33733HIGHEspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and deleteEPSS 0.4%CVE-2023-23379HIGHMicrosoft Defender for IoT Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-50024MEDIUMGitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git serverEPSS 0.4%CVE-2023-29189MEDIUMHTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)EPSS 0.4%CVE-2026-5422MEDIUMPath Traversal in jupyter/jupyterEPSS 0.4%CVE-2026-44948MEDIUMPath Traversal in Rancher Fleet ImageScan GitRepo Path HandlerEPSS 0.4%CVE-2025-41268HIGHNozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in versionEPSS 0.4%CVE-2026-58522MEDIUMMicrosoft Edge for Android Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-29201HIGHInsufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relaEPSS 0.4%CVE-2025-41271HIGHNozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.EPSS 0.4%CVE-2025-58467LOWQsync CentralEPSS 0.4%CVE-2025-25130HIGHWordPress Delete Comments By Status plugin <= 1.5.3 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2026-66881HIGHPath traversal in imported file_entries name allows arbitrary file write via URL-type entry downloadEPSS 0.4%CVE-2026-5966HIGHTeamT5｜ThreatSonar Anti-Ransomware - Arbitrary File DeletionEPSS 0.4%CVE-2025-59835HIGHLangBot has a cross-directory file upload vulnerability, which could lead to system takeoverEPSS 0.4%CVE-2026-87747MEDIUMRagic｜Enterprise Cloud Database - Arbitrary File ReadEPSS 0.4%CVE-2026-30345HIGHA zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside theEPSS 0.4%