Falhas do tipo CWE-22

6.014 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2026-19438HIGHMint Workbench I Path traversal VulnerabilityEPSS 0.3%CVE-2026-17424MEDIUMVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.3%CVE-2024-50559MEDIUMA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM EPSS 0.3%CVE-2023-2270HIGHLocal privilege escalationEPSS 0.3%CVE-2024-23216MEDIUMA path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS VenturaEPSS 0.3%CVE-2025-61646LOWWatchlist group mode reveals authors of edits with hidden authorshipEPSS 0.3%CVE-2025-43190MEDIUMA parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 26 and iPadOS 26,EPSS 0.3%CVE-2025-61658LOWSpecial:GlobalContributions shows edits on wikis the viewer doesn't have access toEPSS 0.3%CVE-2025-10559HIGHPath Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-10933MEDIUMOpenBSD readdir directory traversalEPSS 0.3%CVE-2025-8941HIGHLinux-pam: incomplete fix for cve-2025-6020EPSS 0.3%CVE-2025-53905MEDIUMVim has path traversial issue with tar.vim and special crafted tar filesEPSS 0.3%CVE-2023-4782MEDIUMTerraform Allows Arbitrary File Write During Init OperationEPSS 0.3%CVE-2025-24329MEDIUMOAM service path traversal issue caused by a crafted SOAP message archive field within the RAN management networkEPSS 0.3%CVE-2017-20181MEDIUMhgzojer Vocable Trainer VocableTrainerProvider.java path traversalEPSS 0.3%CVE-2025-69619MEDIUMA path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.EPSS 0.3%CVE-2026-86136HIGHFireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant AEPSS 0.3%CVE-2026-10264MEDIUMlharries whatsapp-mcp Send API Endpoint main.go SendMessageRequest path traversalEPSS 0.3%CVE-2024-6281HIGHPath Traversal in parisneo/lollmsEPSS 0.3%CVE-2025-55214MEDIUMCopier safe template has filesystem write access outside destination pathEPSS 0.3%