Falhas do tipo CWE-22

6.630 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2022-25936HIGHVersions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable. EPSS 1.4%CVE-2024-46446CRITICALMecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. ParameterEPSS 1.4%CVE-2023-44169—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php.EPSS 1.4%CVE-2023-43216—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.EPSS 1.4%CVE-2023-44172—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php.EPSS 1.4%CVE-2023-44171—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php.EPSS 1.4%CVE-2023-44170—SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php.EPSS 1.4%CVE-2021-24447—WP Image Zoom < 1.47 - Local File InclusionEPSS 1.4%CVE-2026-59863HIGHKiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRFEPSS 1.4%CVE-2026-55224HIGHMineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/UninstallEPSS 1.4%CVE-2024-13725CRITICALKeap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File InclusionEPSS 1.4%CVE-2018-16473—A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.EPSS 1.4%CVE-2019-1765HIGHCisco IP Phone 8800 Series Path Traversal VulnerabilityEPSS 1.4%CVE-2022-45299CRITICALAn issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.EPSS 1.4%CVE-2025-54386HIGHTraefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code ExecutionEPSS 1.4%CVE-2026-76506HIGHCisco Unified Computing System Central Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-40524CRITICALDirectory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\application.py EPSS 1.4%CVE-2019-3902MEDIUMA flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and EPSS 1.4%CVE-2021-24692—Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path TraversalEPSS 1.4%CVE-2026-67918HIGHDirectory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath fuEPSS 1.4%