Falhas do tipo CWE-22

5.807 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2014-0750—GE Proficy HMI/SCADA Path TraversalEPSS 70.2%CVE-2021-32682CRITICALMultiple vulnerabilities leading to RCEEPSS 69.9%CVE-2023-40497CRITICALLG Simple Editor saveXml Directory Traversal Remote Code Execution VulnerabilityEPSS 69.4%CVE-2022-44635HIGHApache Fineract allowed an authenticated user to perform remote code execution due to path traversalEPSS 68.8%CVE-2023-40028MEDIUMArbitrary file read via symlinks in GhostEPSS 68.7%CVE-2020-4430MEDIUMIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An aEPSS 68.5%KEVCVE-2024-23535HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 68.1%CVE-2024-24994HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 68.1%CVE-2021-29492HIGHBypass of path matching rules using escaped slash charactersEPSS 66.2%CVE-2021-39316HIGHZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information DislosureEPSS 65.8%CVE-2026-34909CRITICALA malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the uEPSS 65.0%KEVCVE-2022-31474HIGHWordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory TraversalEPSS 63.8%CVE-2022-30547CRITICALA directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specialEPSS 63.7%CVE-2015-4068CRITICALDirectory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denEPSS 63.6%KEVCVE-2023-35081HIGHA path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticatEPSS 63.6%KEVCVE-2024-13179HIGHPath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.EPSS 63.0%CVE-2023-34096MEDIUMThruk has Path Traversal Vulnerability in panorama.pmEPSS 62.7%CVE-2024-6781HIGHCalibre Arbitrary File ReadEPSS 62.4%CVE-2023-41182HIGHNETGEAR ProSAFE Network Management System ZipUtils Directory Traversal Remote Code Execution VulnerabilityEPSS 62.3%CVE-2020-27128MEDIUMCisco SD-WAN vManage Software Arbitrary File Creation VulnerabilityEPSS 60.8%