Falhas do tipo CWE-22

5.839 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2021-43836HIGHPHP file inclusion in the Sulu admin panelEPSS 2.0%CVE-2019-18253—An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.1EPSS 2.0%CVE-2022-31473MEDIUMBIG-IP APM Appliance mode vulnerability CVE-2022-31473EPSS 2.0%CVE-2023-50785LOWZoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal.EPSS 2.0%CVE-2017-15894—Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and beforeEPSS 2.0%CVE-2021-32840HIGHPath Traversal in SharpZipLibEPSS 2.0%CVE-2017-15895—Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authentEPSS 2.0%CVE-2023-30626HIGHJellyfin vulnerable to directory traversal and file write causing arbitrary code executionEPSS 2.0%CVE-2022-43864HIGHIBM Business Automation Workflow information disclosureEPSS 2.0%CVE-2019-10242—In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversEPSS 2.0%CVE-2024-31818CRITICALDirectory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.pEPSS 1.9%CVE-2021-1259MEDIUMCisco SD-WAN vManage Software Path Traversal VulnerabilityEPSS 1.9%CVE-2021-33178—The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. EPSS 1.9%CVE-2017-9270HIGHpost-auth arbitrary file write on cryptctl serverEPSS 1.9%CVE-2025-34110CRITICALColoradoFTP Server <= 1.3 Build 8 Path Traversal Information DisclosureEPSS 1.9%CVE-2022-46256HIGHPath traversal in GitHub Enterprise Server leading to remote code execution in GitHub PagesEPSS 1.9%CVE-2023-22273HIGHZDI-CAN-21307: Adobe RoboHelp Server OnPublishFile Directory Traversal Remote Code Execution VulnerabilityEPSS 1.9%CVE-2023-35840MEDIUM_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.EPSS 1.9%CVE-2014-10068—The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden`EPSS 1.9%CVE-2022-23612HIGHDirectory Traversal in OpenMRS Startup FilterEPSS 1.9%