Fallos del tipo CWE-24

119 resultados

Travessia de diretórios com caminho relativo

A aplicação aceita entrada do usuário para construir caminhos de arquivo sem validar adequadamente sequências como '../', permitindo que um atacante navegue para fora do diretório esperado e acesse arquivos sensíveis do sistema. O perigo está em confiar na entrada sem sanitização, expondo arquivos que não deveriam ser acessíveis.

Ejemplo

Um site permite download de arquivos: GET /download?file=relatorio.pdf funciona, mas GET /download?file=../../../etc/passwd lê o arquivo de senhas do sistema, já que o caminho relativo não foi filtrado.

Cómo mitigar

Valide e canonicalize caminhos antes do acesso (converta ../relativo para absoluto), use listas brancas de arquivos permitidos, e confine acessos a um diretório raiz específico. Em linguagens modernas, use APIs seguras que não resolvem '..' em caminhos.

CVE-2025-51661HIGHA path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use locaEPSS 0.5%CVE-2025-46094LOWLiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript.EPSS 0.5%CVE-2025-67845MEDIUMA Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to injEPSS 0.5%CVE-2023-20098MEDIUMA vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vEPSS 0.5%CVE-2024-2564MEDIUMPandaXGO PandaX user.go ExportUser path traversalEPSS 0.5%CVE-2023-20167MEDIUMCisco Identity Services Engine Path Traversal VulnerabilitiesEPSS 0.5%CVE-2025-63298HIGHA path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php cEPSS 0.5%CVE-2025-30343LOWA directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in foldersEPSS 0.5%CVE-2024-12897MEDIUMIntelbras VIP S4320 G2 Web Interface Sha1Account1 path traversalEPSS 0.5%CVE-2025-48050HIGHIn DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory.EPSS 0.5%CVE-2021-3710MEDIUMApport info disclosure via path traversal bug in read_fileEPSS 0.5%CVE-2024-37403MEDIUMIvanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize fileEPSS 0.5%CVE-2025-2961MEDIUMopensolon org.noear.solon.core.handle.RenderManager aa render_mav path traversalEPSS 0.5%CVE-2025-45582MEDIUMGNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victEPSS 0.4%CVE-2026-46687HIGHEmlog Local File Inclusion (LFI)EPSS 0.4%CVE-2025-57563MEDIUMA path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows unauthenticated attackers to read arbitrary files.EPSS 0.4%CVE-2026-28427MEDIUMOpenDeck affected by path traversal allows arbitrary file readEPSS 0.4%CVE-2026-48047MEDIUMXWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) adminEPSS 0.4%CVE-2026-44942MEDIUMlibzypp .repo files can have an optional path which can lead to path traversal attacksEPSS 0.4%CVE-2026-49103CRITICALWebmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxeEPSS 0.4%