Falhas do tipo CWE-22

5.809 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2021-22720—A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and EPSS 30.5%CVE-2023-52085LOWWinter CMS Local File Inclusion through Server Side Template Injection EPSS 30.2%CVE-2024-25125MEDIUMAbsolute path traversal vulnerability in digdag serverEPSS 29.6%CVE-2012-6664CRITICALMultiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to readEPSS 29.5%CVE-2017-0901—RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any fEPSS 29.4%CVE-2024-32002CRITICALGit's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code ExecutionEPSS 29.2%CVE-2018-2380MEDIUMSAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thuEPSS 28.9%KEVCVE-2023-51449MEDIUMMake the `/file` secure against file traversal attacksEPSS 28.3%CVE-2022-47945CRITICALThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_oEPSS 28.3%CVE-2026-20262MEDIUMCisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityEPSS 28.2%KEVCVE-2026-22557CRITICALA malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access fEPSS 28.1%CVE-2024-13180HIGHPath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addEPSS 27.8%CVE-2025-27590CRITICALIn oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux usEPSS 27.6%CVE-2020-12146MEDIUMSilver Peak Unity OrchestratorTM subject to path traversal.EPSS 27.6%CVE-2018-3758—Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.EPSS 27.5%CVE-2024-30270MEDIUMmailcow Path Traversal and Arbitrary Code Execution VulnerabilityEPSS 27.3%CVE-2021-22718—A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and EPSS 27.2%CVE-2007-4559CRITICALDirectory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remotEPSS 27.1%CVE-2025-11201HIGHMLflow Tracking Server Model Creation Directory Traversal Remote Code Execution VulnerabilityEPSS 27.0%CVE-2025-11001HIGH7-Zip ZIP File Parsing Directory Traversal Remote Code Execution VulnerabilityEPSS 27.0%