Falhas do tipo CWE-22

5.134 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2019-16278CRITICALDirectory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a cEPSS 99.0%KEVCVE-2023-47246CRITICALIn SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat weEPSS 98.9%KEVCVE-2024-8963CRITICALPath Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.EPSS 98.6%KEVCVE-2022-27925HIGHZimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenEPSS 98.6%KEVCVE-2019-5418HIGHThere is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accepEPSS 98.5%KEVCVE-2024-41713CRITICALA vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthentiEPSS 98.1%KEVCVE-2020-11738HIGHThe Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the fEPSS 97.8%KEVCVE-2025-61884HIGHVulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected aEPSS 97.8%KEVCVE-2025-34028CRITICALCommvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path TraversalEPSS 97.7%KEVCVE-2021-40444HIGHMicrosoft MSHTML Remote Code Execution VulnerabilityEPSS 97.2%KEVCVE-2021-41277CRITICALGeoJSON URL validation can expose server files and environment variables to unauthorized usersEPSS 97.2%KEVCVE-2019-3398HIGHConfluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permiEPSS 97.0%KEVCVE-2020-3187CRITICALCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal VulnerabilityEPSS 96.6%CVE-2018-14847CRITICALMikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write aEPSS 96.1%KEVCVE-2019-20085HIGHTVT NVMS-1000 devices allow GET /.. Directory TraversalEPSS 96.1%KEVCVE-2016-0752HIGHDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, anEPSS 95.5%KEVCVE-2022-41352CRITICALAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophEPSS 95.5%KEVCVE-2024-57727CRITICALSimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated reEPSS 95.2%KEVCVE-2017-12637HIGHDirectory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allowsEPSS 94.6%KEVCVE-2024-9047CRITICALWordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.phpEPSS 93.2%