Falhas do tipo CWE-22

5.819 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2024-34832CRITICALDirectory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded toEPSS 5.0%CVE-2021-24453—Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoningEPSS 5.0%CVE-2018-1162—This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Quest NetVault Backup 11.2EPSS 4.9%CVE-2021-24644—Images to WebP < 1.9 - Authenticated Local File InclusionEPSS 4.9%CVE-2019-13551—Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vulnerabilities are caused by a lack of proper validation of a user-supplEPSS 4.9%CVE-2020-14507—Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/dowEPSS 4.9%CVE-2025-2505CRITICALAge Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'EPSS 4.9%CVE-2017-16610—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. AuthenticatiEPSS 4.8%CVE-2020-1631HIGHOut of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) servicesEPSS 4.8%KEVCVE-2021-3762—A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted containeEPSS 4.8%CVE-2018-14806—Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code.EPSS 4.8%CVE-2024-12088MEDIUMRsync: --safe-links option bypass leads to path traversalEPSS 4.7%CVE-2023-29887HIGHA Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the FilEPSS 4.7%CVE-2020-6109HIGHAn exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A speciallEPSS 4.7%CVE-2018-0420MEDIUMCisco Wireless LAN Controller Software Directory Traversal VulnerabilityEPSS 4.6%CVE-2023-50916HIGHKyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local paEPSS 4.6%CVE-2024-30851MEDIUMDirectory Traversal vulnerability in codesiddhant Jasmin Ransomware v.1.0.1 allows an attacker to obtain sensitive information via the downlEPSS 4.6%CVE-2019-6754HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interactionEPSS 4.5%CVE-2020-27870HIGHThis vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1EPSS 4.5%CVE-2023-6015CRITICALMLflow Arbitrary File UploadEPSS 4.4%