Falhas do tipo CWE-22

5.822 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2024-45436CRITICALextractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.EPSS 2.6%CVE-2026-47932HIGHColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 2.5%CVE-2023-4613CRITICALUpload Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityEPSS 2.5%CVE-2022-21675CRITICALBytecode Viewer v2.10.x Zip SlipEPSS 2.5%CVE-2024-23466CRITICALSolarWinds Access Rights Manager Directory Traversal Remote Code Execution VulnerabilityEPSS 2.5%CVE-2018-1002207—mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to wrEPSS 2.5%CVE-2023-40517HIGHLG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure VulnerabilityEPSS 2.5%CVE-2020-14352—A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in reEPSS 2.5%CVE-2024-39786CRITICALMultiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially EPSS 2.5%CVE-2024-39787CRITICALMultiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially EPSS 2.5%CVE-2022-27657—A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient vEPSS 2.5%CVE-2017-6629—A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files iEPSS 2.5%CVE-2019-15600—A Path traversal exists in http_server which allows an attacker to read arbitrary system files.EPSS 2.5%CVE-2023-4614CRITICALsetThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityEPSS 2.5%CVE-2026-9290HIGHWP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query ParameterEPSS 2.5%CVE-2018-7503—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 2.5%CVE-2023-51639CRITICALAllegra downloadExportedChart Directory Traversal Authentication Bypass VulnerabilityEPSS 2.5%CVE-2022-29511CRITICALA directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1EPSS 2.5%CVE-2023-37460HIGHPlexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiverEPSS 2.5%CVE-2022-25249HIGHPTC Axeda agent and Axeda Desktop Server Path TraversalEPSS 2.5%