Falhas do tipo CWE-23

509 resultados

Traversal de diretório por falta de validação de caminho

O software usa entrada externa para construir um caminho de arquivo, mas não neutraliza sequências como '..' que podem escapar do diretório restrito. Um atacante pode acessar ou manipular arquivos fora da área permitida usando essas sequências de navegação.

Exemplo

Uma API de download de documentos recebe o parâmetro 'arquivo=relatorio.pdf' e monta o caminho '/home/docs/' + arquivo. Se o atacante enviar 'arquivo=../../etc/passwd', o caminho resultante '/home/docs/../../etc/passwd' resolve para '/etc/passwd', expondo informações sensíveis do sistema.

Como mitigar

Valide e normalize o caminho completo resolvido (use realpath() ou Path.resolve()) e verifique se fica dentro do diretório permitido; alterne para uma whitelist de arquivos conhecidos ou use índices seguros em vez de construir caminhos diretamente com entrada do usuário.

CVE-2025-62498HIGHAutomationDirect Productivity Suite Relative Path TraversalEPSS 0.5%CVE-2026-8387LOWRelative Path Traversal in allegroai/clearmlEPSS 0.5%CVE-2025-13161HIGHIQ Service International｜IQ-Support - Arbitrary File ReadEPSS 0.5%CVE-2024-47856CRITICALIn RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or morEPSS 0.5%CVE-2026-27202HIGHGetSimple CMS: Uploaded Files (feature) Arbitrary File Read VulnerabilityEPSS 0.5%CVE-2024-47948MEDIUMIn JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backupsEPSS 0.5%CVE-2026-44941HIGHlibzypp path traversal via "keyhint" in repomd.xmlEPSS 0.5%CVE-2023-35816LOWDevExpress before 23.1.3 allows arbitrary TypeConverter conversion.EPSS 0.5%CVE-2025-24343MEDIUMA vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) atEPSS 0.5%CVE-2024-46664MEDIUMA relative path traversal in Fortinet FortiRecorder [CWE-23] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to reEPSS 0.5%CVE-2026-66906CRITICALApache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDirEPSS 0.5%CVE-2025-15225HIGHSunnet｜WMPro - Arbitrary File ReadEPSS 0.5%CVE-2026-50016HIGHpnpm: Transitive dependency alias path traversal allows project path override via symlink replacementEPSS 0.5%CVE-2025-48977HIGHApache Ignite: REST HTTP arbitrary file read vulnerabilityEPSS 0.5%CVE-2023-30630HIGHDmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode viEPSS 0.5%CVE-2025-9570MEDIUMSunnet｜eHRD CTMS - Arbitrary File Reading through Path TraversalEPSS 0.5%CVE-2026-33494CRITICALOry Oathkeeper has a path traversal authorization bypassEPSS 0.5%CVE-2026-29778HIGHpyLoad: Arbitrary File Write via Path Traversal in edit_package()EPSS 0.5%CVE-2025-23360HIGHNVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successfuEPSS 0.5%CVE-2023-0745MEDIUMArbitrary File Write in High Availability Backup UploadEPSS 0.5%