Fallos del tipo CWE-23

509 resultados

Travessia de diretório via normalização de caminho inadequada

A aplicação constrói caminhos de arquivo usando entrada do usuário sem neutralizar sequências como '..' (parent directory), permitindo acesso a arquivos fora do diretório restrito pretendido. Mesmo com validações parciais, um atacante consegue contorná-las usando variações de codificação ou normalização diferida.

Ejemplo

Um sistema de gerenciamento de documentos valida se o arquivo solicitado começa com '/uploads/', mas não normaliza '..' antes da validação. Requisição GET /document?file=/uploads/../../../etc/passwd permite ler /etc/passwd. O '..' é processado após a validação passar.

Cómo mitigar

Normalize o caminho completo (resolver symlinks, '..' e '.') ANTES de qualquer validação, depois verifique se o resultado está dentro do diretório permitido. Use APIs seguras da linguagem (realpath em C, Path.getCanonicalPath em Java, Path.resolve e comparação em Python) e sempre implemente validação com whitelist, não blacklist de caracteres.

CVE-2018-10615—Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prioEPSS 2.6%CVE-2021-34605HIGHXinje XD/E Series PLC Program Tool Zip SlipEPSS 2.5%CVE-2023-2913HIGHRockwell Automation ThinManager ThinServer Path Traversal VulnerabilityEPSS 2.4%CVE-2026-54066HIGHSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)EPSS 2.4%CVE-2022-31163HIGHTZInfo relative path traversal vulnerability allows loading of arbitrary filesEPSS 2.4%CVE-2024-30010HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 2.3%CVE-2020-12026—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a loEPSS 2.3%CVE-2021-29101HIGHArcGIS GeoEvent Server has a Directory Traversal security vulnerability.EPSS 2.3%CVE-2018-14795—DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace EPSS 2.2%CVE-2020-8254—A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicioEPSS 2.1%CVE-2025-27410MEDIUMPwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as adminEPSS 2.1%CVE-2021-32954—Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbiEPSS 2.1%CVE-2020-25172—B. Braun OnlineSuiteEPSS 2.0%CVE-2019-17640—In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, EPSS 2.0%CVE-2026-31831HIGHTautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpointEPSS 2.0%CVE-2019-13408—Advan VD-1 allows users to download arbitrary filesEPSS 1.9%CVE-2020-7008—VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, EPSS 1.9%CVE-2022-20790MEDIUMCisco Unified Communications Products Arbitrary File Read VulnerabilityEPSS 1.9%CVE-2018-12473LOWpath traversal in obs-service-tar_scmEPSS 1.8%CVE-2024-47051CRITICALRemote Code Execution & File Deletion in Asset UploadsEPSS 1.8%