Falhas do tipo CWE-22

5.950 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2024-41792CRITICALA vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices contains a patEPSS 0.6%CVE-2024-31232HIGHWordPress Rehub theme <= 19.6.1 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2025-24569HIGHWordPress PDF Generator Addon for Elementor Page Builder plugin <= 1.7.5 - Arbitrary File Read vulnerabilityEPSS 0.6%CVE-2025-21095MEDIUMKeysight Ixia Vision Product Family Path TraversalEPSS 0.6%CVE-2024-44013HIGHWordPress VR Calendar plugin <= 2.4.0 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2025-3317MEDIUMfumiao opencms dataPage.jsp path traversalEPSS 0.6%CVE-2025-27101HIGHBroken Access Control in Opal filesystem's copy functionality exposes all user dataEPSS 0.6%CVE-2025-4175MEDIUMAlanBinu007 Spring-Boot-Advanced-Projects Upload Profile API Endpoint UserProfileController.java uploadUserProfileImage path traversalEPSS 0.6%CVE-2026-34522HIGHSillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directoryEPSS 0.6%CVE-2026-33293HIGHAVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump ParameterEPSS 0.6%CVE-2024-43165MEDIUMWordPress WPSection plugin <= 1.3.8 - Contributor+ Limited Local File Inclusion vulnerabilityEPSS 0.6%CVE-2026-54083HIGHWazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletionEPSS 0.6%CVE-2024-49780MEDIUMIBM OpenPages path traversalEPSS 0.6%CVE-2024-55597MEDIUMA improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows atEPSS 0.6%CVE-2026-33686HIGHSharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtilEPSS 0.6%CVE-2024-42474MEDIUMStreamlit Path Traversal Security Vulnerability on WindowsEPSS 0.6%CVE-2026-72773MEDIUMn8n before 2.32.1 Path Traversal via computer-use search_filesEPSS 0.6%CVE-2023-5588LOWkphrx pleroma pack.ex Pleroma.Emoji.Pack path traversalEPSS 0.6%CVE-2026-53825HIGHOpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write ScopeEPSS 0.6%CVE-2024-43957MEDIUMWordPress Animated Number Counters plugin <= 1.9 - Editor+ Limited Local File Inclusion vulnerabilityEPSS 0.6%