Falhas do tipo CWE-23

509 resultados

Traversal de diretório por falta de validação de caminho

O software usa entrada externa para construir um caminho de arquivo, mas não neutraliza sequências como '..' que podem escapar do diretório restrito. Um atacante pode acessar ou manipular arquivos fora da área permitida usando essas sequências de navegação.

Exemplo

Uma API de download de documentos recebe o parâmetro 'arquivo=relatorio.pdf' e monta o caminho '/home/docs/' + arquivo. Se o atacante enviar 'arquivo=../../etc/passwd', o caminho resultante '/home/docs/../../etc/passwd' resolve para '/etc/passwd', expondo informações sensíveis do sistema.

Como mitigar

Valide e normalize o caminho completo resolvido (use realpath() ou Path.resolve()) e verifique se fica dentro do diretório permitido; alterne para uma whitelist de arquivos conhecidos ou use índices seguros em vez de construir caminhos diretamente com entrada do usuário.

CVE-2026-57988HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2021-41127HIGHMaliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasaEPSS 0.8%CVE-2018-5448MEDIUMMedtronic 2090 Carelink Programmer Relative Path TraversalEPSS 0.7%CVE-2024-24938MEDIUMIn JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentationEPSS 0.7%CVE-2024-54154HIGHIn JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandboxEPSS 0.7%CVE-2023-1043MEDIUMMuYuCMS index.php path traversalEPSS 0.7%CVE-2024-3497HIGHDirectory Traversal Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-8134CRITICALConcrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File InclusionEPSS 0.7%CVE-2025-48957HIGHAstrBot Has Path Traversal Vulnerability in /api/chat/get_fileEPSS 0.7%CVE-2025-23011HIGHFedora Repository archive extraction path traversalEPSS 0.7%CVE-2024-45816MEDIUMStorage bucket Directory Traversal in @backstage/plugin-techdocs-backendEPSS 0.7%CVE-2026-63043HIGHApache InLong: Agent path traversal via unvalidated file source pathEPSS 0.7%CVE-2024-10200HIGHWellchoose Administrative Management System - Arbitrary File Read through Path TraversalEPSS 0.7%CVE-2024-0550CRITICALPrivileged User using traversal to read system filesEPSS 0.7%CVE-2024-33615HIGHCyberPower PowerPanel business Relative Path TraversalEPSS 0.7%CVE-2025-8464MEDIUMDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` CookieEPSS 0.7%CVE-2026-33435HIGHWeblate: Remote code execution during backup restorationEPSS 0.7%CVE-2025-30159MEDIUMKirby vulnerable to path traversal of snippet names in the `snippet()` helperEPSS 0.7%CVE-2022-22245MEDIUMJunos OS: Path traversal vulnerability in J-WebEPSS 0.7%CVE-2025-66626HIGHargoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic linksEPSS 0.7%