Falhas do tipo CWE-22

6.560 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2024-11238MEDIUMLandray EKP sysUiComponent.do delPreviewFile path traversalEPSS 5.7%CVE-2022-41840HIGHWordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerabilityEPSS 5.7%CVE-2026-73034CRITICALDB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id HeaderEPSS 5.7%CVE-2025-46704MEDIUMAdvantech iView Path TraversalEPSS 5.7%CVE-2024-45256CRITICALAn arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite databaseEPSS 5.6%CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.6%CVE-2023-31059HIGHRepetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLosEPSS 5.6%CVE-2026-2493HIGHIceWarp collaboration Directory Traversal Information Disclosure VulnerabilityEPSS 5.5%CVE-2018-1002209—QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip EPSS 5.5%CVE-2022-25371—Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizEPSS 5.4%CVE-2025-34452HIGHStreama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File WriteEPSS 5.4%CVE-2017-10940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsEPSS 5.4%CVE-2018-0464—Cisco Data Center Network Manager Path Traversal VulnerabilityEPSS 5.4%CVE-2020-8159—There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentialEPSS 5.4%CVE-2021-21090HIGHAdobe InCopy DOCX file parsing directory traversal vulnerability could lead to remote code executionEPSS 5.4%CVE-2019-16765HIGHIf an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension actEPSS 5.4%CVE-2020-12003—FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContEPSS 5.4%CVE-2021-21514MEDIUMDell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privEPSS 5.4%CVE-2018-11455—A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6EPSS 5.2%CVE-2021-25082—Popup Builder < 4.0.7 - LFI to RCEEPSS 5.2%