Falhas do tipo CWE-23

509 resultados

Traversal de diretório por falta de validação de caminho

O software usa entrada externa para construir um caminho de arquivo, mas não neutraliza sequências como '..' que podem escapar do diretório restrito. Um atacante pode acessar ou manipular arquivos fora da área permitida usando essas sequências de navegação.

Exemplo

Uma API de download de documentos recebe o parâmetro 'arquivo=relatorio.pdf' e monta o caminho '/home/docs/' + arquivo. Se o atacante enviar 'arquivo=../../etc/passwd', o caminho resultante '/home/docs/../../etc/passwd' resolve para '/etc/passwd', expondo informações sensíveis do sistema.

Como mitigar

Valide e normalize o caminho completo resolvido (use realpath() ou Path.resolve()) e verifique se fica dentro do diretório permitido; alterne para uma whitelist de arquivos conhecidos ou use índices seguros em vez de construir caminhos diretamente com entrada do usuário.

CVE-2018-10615—Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prioEPSS 2.6%CVE-2021-34605HIGHXinje XD/E Series PLC Program Tool Zip SlipEPSS 2.5%CVE-2023-2913HIGHRockwell Automation ThinManager ThinServer Path Traversal VulnerabilityEPSS 2.4%CVE-2026-54066HIGHSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)EPSS 2.4%CVE-2022-31163HIGHTZInfo relative path traversal vulnerability allows loading of arbitrary filesEPSS 2.4%CVE-2024-30010HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 2.3%CVE-2020-12026—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a loEPSS 2.3%CVE-2021-29101HIGHArcGIS GeoEvent Server has a Directory Traversal security vulnerability.EPSS 2.3%CVE-2018-14795—DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace EPSS 2.2%CVE-2020-8254—A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicioEPSS 2.1%CVE-2025-27410MEDIUMPwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as adminEPSS 2.1%CVE-2021-32954—Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbiEPSS 2.1%CVE-2020-25172—B. Braun OnlineSuiteEPSS 2.0%CVE-2019-17640—In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, EPSS 2.0%CVE-2026-31831HIGHTautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpointEPSS 2.0%CVE-2019-13408—Advan VD-1 allows users to download arbitrary filesEPSS 1.9%CVE-2020-7008—VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, EPSS 1.9%CVE-2022-20790MEDIUMCisco Unified Communications Products Arbitrary File Read VulnerabilityEPSS 1.9%CVE-2018-12473LOWpath traversal in obs-service-tar_scmEPSS 1.8%CVE-2021-41178HIGHFile Traversal affecting SVG files on Nextcloud ServerEPSS 1.8%