Falhas do tipo CWE-23

552 resultados

Traversal de diretório por falta de validação de caminho

O software usa entrada externa para construir um caminho de arquivo, mas não neutraliza sequências como '..' que podem escapar do diretório restrito. Um atacante pode acessar ou manipular arquivos fora da área permitida usando essas sequências de navegação.

Exemplo

Uma API de download de documentos recebe o parâmetro 'arquivo=relatorio.pdf' e monta o caminho '/home/docs/' + arquivo. Se o atacante enviar 'arquivo=../../etc/passwd', o caminho resultante '/home/docs/../../etc/passwd' resolve para '/etc/passwd', expondo informações sensíveis do sistema.

Como mitigar

Valide e normalize o caminho completo resolvido (use realpath() ou Path.resolve()) e verifique se fica dentro do diretório permitido; alterne para uma whitelist de arquivos conhecidos ou use índices seguros em vez de construir caminhos diretamente com entrada do usuário.

CVE-2024-27199HIGHIn JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possibleEPSS 100.0%KEVCVE-2020-5410HIGHDirectory Traversal with spring-cloud-config-serverEPSS 95.6%KEVCVE-2025-64446CRITICALA relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9EPSS 91.1%KEVCVE-2020-5405—Directory Traversal with spring-cloud-config-serverEPSS 68.5%CVE-2025-55752HIGHApache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabledEPSS 64.4%CVE-2022-23854HIGHAVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated userEPSS 49.7%CVE-2020-17518—Apache Flink directory traversal attack: remote file writing through the REST APIEPSS 49.1%CVE-2024-52012MEDIUMApache Solr: Configset upload on Windows allows arbitrary path write-accessEPSS 47.1%CVE-2020-5284MEDIUMDirectory Traversal in Next.js versions below 9.3.2EPSS 44.8%CVE-2024-2053HIGHArtica Proxy Unauthenticated LFI Protection Bypass VulnerabilityEPSS 44.6%CVE-2018-18990—LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can levEPSS 39.5%CVE-2021-43555HIGHmySCADA myDESIGNEREPSS 38.2%CVE-2022-29844MEDIUMWestern Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftpEPSS 36.4%CVE-2024-47949MEDIUMIn JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary locationEPSS 32.1%CVE-2024-24942MEDIUMIn JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archivesEPSS 32.0%CVE-2021-20040—A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages orEPSS 25.1%CVE-2023-34990CRITICALA relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized cEPSS 25.0%CVE-2025-34510HIGHSitecore XM, XC, and XP Post-Auth RCE via Zip SlipEPSS 24.8%CVE-2026-41948CRITICALDify v1.14.1 Path Traversal via Plugin Daemon Internal API AccessEPSS 22.7%CVE-2024-43454HIGHWindows Remote Desktop Licensing Service Remote Code Execution VulnerabilityEPSS 21.9%