Falhas do tipo CWE-23

509 resultados

Traversal de diretório por falta de validação de caminho

O software usa entrada externa para construir um caminho de arquivo, mas não neutraliza sequências como '..' que podem escapar do diretório restrito. Um atacante pode acessar ou manipular arquivos fora da área permitida usando essas sequências de navegação.

Exemplo

Uma API de download de documentos recebe o parâmetro 'arquivo=relatorio.pdf' e monta o caminho '/home/docs/' + arquivo. Se o atacante enviar 'arquivo=../../etc/passwd', o caminho resultante '/home/docs/../../etc/passwd' resolve para '/etc/passwd', expondo informações sensíveis do sistema.

Como mitigar

Valide e normalize o caminho completo resolvido (use realpath() ou Path.resolve()) e verifique se fica dentro do diretório permitido; alterne para uma whitelist de arquivos conhecidos ou use índices seguros em vez de construir caminhos diretamente com entrada do usuário.

CVE-2022-30299MEDIUMA path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versionsEPSS 0.5%CVE-2025-0225MEDIUMTsinghua Unigroup Electronic Archives System exampleDownload.html path traversalEPSS 0.5%CVE-2026-25575HIGHNavigaTUM has a Path Traversal Vulnerability in the propose_edits functionalityEPSS 0.5%CVE-2024-12897MEDIUMIntelbras VIP S4320 G2 Web Interface Sha1Account1 path traversalEPSS 0.5%CVE-2025-47788CRITICALMissing Path Validation Enables Path Traversal in Controller.phpEPSS 0.5%CVE-2025-27791HIGHCollabora Online Vulnerable to Arbitrary File WriteEPSS 0.5%CVE-2026-63490HIGHHandlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypassEPSS 0.5%CVE-2025-53082MEDIUMAn 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations on EPSS 0.5%CVE-2025-52922HIGHInnoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel coEPSS 0.5%CVE-2025-58463LOWDownload StationEPSS 0.5%CVE-2026-59832HIGHSiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.dbEPSS 0.5%CVE-2026-27625HIGHStirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP ExtractionEPSS 0.5%CVE-2026-23888MEDIUMpnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)EPSS 0.5%CVE-2026-93468HIGHHGiga｜OAKlouds - Arbitrary File ReadEPSS 0.5%CVE-2026-54910HIGHFileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary filesEPSS 0.5%CVE-2024-12019HIGHArbitrary File Read via Document APIEPSS 0.5%CVE-2024-9405MEDIUMAn incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unEPSS 0.5%CVE-2025-59336MEDIUMRelative Path Traversal in LuanoxEPSS 0.5%CVE-2025-2961MEDIUMopensolon org.noear.solon.core.handle.RenderManager aa render_mav path traversalEPSS 0.5%CVE-2026-76440CRITICALCisco Secure Email Gateway Security Hardening ReleaseEPSS 0.5%