Fallos del tipo CWE-23

552 resultados

Travessia de diretório via normalização de caminho inadequada

A aplicação constrói caminhos de arquivo usando entrada do usuário sem neutralizar sequências como '..' (parent directory), permitindo acesso a arquivos fora do diretório restrito pretendido. Mesmo com validações parciais, um atacante consegue contorná-las usando variações de codificação ou normalização diferida.

Ejemplo

Um sistema de gerenciamento de documentos valida se o arquivo solicitado começa com '/uploads/', mas não normaliza '..' antes da validação. Requisição GET /document?file=/uploads/../../../etc/passwd permite ler /etc/passwd. O '..' é processado após a validação passar.

Cómo mitigar

Normalize o caminho completo (resolver symlinks, '..' e '.') ANTES de qualquer validação, depois verifique se o resultado está dentro do diretório permitido. Use APIs seguras da linguagem (realpath em C, Path.getCanonicalPath em Java, Path.resolve e comparação em Python) e sempre implemente validação com whitelist, não blacklist de caracteres.

CVE-2022-2922MEDIUMRelative Path Traversal in dnnsoftware/dnn.platformEPSS 1.3%CVE-2023-20040MEDIUMA vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause aEPSS 1.3%CVE-2024-11067HIGHD-Link DSL6740C - Arbitrary File Reading through Path TraversalEPSS 1.3%CVE-2019-11822MEDIUMRelative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remoEPSS 1.3%CVE-2023-33144MEDIUMVisual Studio Code Spoofing VulnerabilityEPSS 1.3%CVE-2019-19287—A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow attackers to traverse through the file systemEPSS 1.3%CVE-2026-51026MEDIUMDirectory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request.EPSS 1.3%CVE-2023-4760HIGHRemote Code Execution in Eclipse RAP on WindowsEPSS 1.3%CVE-2021-41152HIGHPath Traversal in Folder Component Leading to Local File InclusionEPSS 1.2%CVE-2026-62837MEDIUMMicrosoft SharePoint Server Information Disclosure VulnerabilityEPSS 1.2%CVE-2025-2007HIGHImport Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 1.2%CVE-2026-14903HIGHPath traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web rEPSS 1.2%CVE-2025-27610HIGHLocal File Inclusion in Rack::StaticEPSS 1.2%CVE-2025-48817HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 1.1%CVE-2021-29100HIGHArcGIS Earth has a File Parsing Directory Traversal VulnerabilityEPSS 1.1%CVE-2021-24035—A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 EPSS 1.1%CVE-2021-22870—Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read accessEPSS 1.1%CVE-2025-32409HIGHRatta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image (signed with debug keys) cEPSS 1.1%CVE-2021-34594MEDIUMBeckhoff: Relative path traversal vulnerability through TwinCAT OPC UA ServerEPSS 1.1%CVE-2020-7376HIGHRapid7 Metasploit Framework Relative Path Traversal in enum_osx moduleEPSS 1.1%