Falhas do tipo CWE-22

5.819 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2017-10940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsEPSS 5.4%CVE-2018-0464—Cisco Data Center Network Manager Path Traversal VulnerabilityEPSS 5.4%CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.4%CVE-2021-21090HIGHAdobe InCopy DOCX file parsing directory traversal vulnerability could lead to remote code executionEPSS 5.4%CVE-2019-16765HIGHIf an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension actEPSS 5.4%CVE-2021-21514MEDIUMDell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privEPSS 5.4%CVE-2018-11455—A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6EPSS 5.3%CVE-2020-8159—There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentialEPSS 5.3%CVE-2020-12003—FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContEPSS 5.2%CVE-2021-25082—Popup Builder < 4.0.7 - LFI to RCEEPSS 5.2%CVE-2017-3851—A Directory Traversal vulnerability in the web framework code of the Cisco application-hosting framework (CAF) component of the Cisco IOx apEPSS 5.2%CVE-2013-3993MEDIUMIBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access unEPSS 5.2%KEVCVE-2026-24208MEDIUMNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vEPSS 5.2%CVE-2020-8131—Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead EPSS 5.2%CVE-2019-10220HIGHLinux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.EPSS 5.1%CVE-2026-73034CRITICALDB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id HeaderEPSS 5.1%CVE-2019-12691MEDIUMCisco Firepower Management Center Directory Traversal VulnerabilityEPSS 5.1%CVE-2022-25371—Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizEPSS 5.1%CVE-2021-40661HIGHA remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing TerminEPSS 5.1%CVE-2024-7340HIGHW&B Weave server remote arbitrary file leak and privilege escalationEPSS 5.0%