Falhas do tipo CWE-23

509 resultados

Traversal de diretório por falta de validação de caminho

O software usa entrada externa para construir um caminho de arquivo, mas não neutraliza sequências como '..' que podem escapar do diretório restrito. Um atacante pode acessar ou manipular arquivos fora da área permitida usando essas sequências de navegação.

Exemplo

Uma API de download de documentos recebe o parâmetro 'arquivo=relatorio.pdf' e monta o caminho '/home/docs/' + arquivo. Se o atacante enviar 'arquivo=../../etc/passwd', o caminho resultante '/home/docs/../../etc/passwd' resolve para '/etc/passwd', expondo informações sensíveis do sistema.

Como mitigar

Valide e normalize o caminho completo resolvido (use realpath() ou Path.resolve()) e verifique se fica dentro do diretório permitido; alterne para uma whitelist de arquivos conhecidos ou use índices seguros em vez de construir caminhos diretamente com entrada do usuário.

CVE-2021-41178HIGHFile Traversal affecting SVG files on Nextcloud ServerEPSS 1.8%CVE-2025-55748CRITICALXWiki Platform's configuration files can be accessed through jsx and sx endpointsEPSS 1.8%CVE-2022-23732—Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protectionsEPSS 1.7%CVE-2023-20066MEDIUMCisco IOS XE Software Web UI Path Traversal VulnerabilityEPSS 1.7%CVE-2025-55747CRITICALXWiki Platform's configuration files can be accessed through the webjars APIEPSS 1.7%CVE-2019-3976—RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgradeEPSS 1.7%CVE-2025-46002MEDIUMAn issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanEPSS 1.7%CVE-2019-11826HIGHRelative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users EPSS 1.7%CVE-2025-59341HIGHLocal File Inclusion in esm.shEPSS 1.6%CVE-2019-13944—A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versiEPSS 1.6%CVE-2025-52207CRITICALPBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.EPSS 1.6%CVE-2020-25150HIGHB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusEPSS 1.5%CVE-2022-38205HIGHPortal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)EPSS 1.5%CVE-2020-10631—An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.EPSS 1.5%CVE-2024-20352MEDIUMA vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which coEPSS 1.5%CVE-2022-20862MEDIUMCisco Unified Communications Manager Arbitrary File Read VulnerabilityEPSS 1.5%CVE-2020-7861HIGHAnySupport directory traversing vulnerabilityEPSS 1.5%CVE-2021-41242HIGHPath Traversal in some REST methods leading to file upload to arbitrary placesEPSS 1.4%CVE-2020-3597MEDIUMCisco Nexus Data Broker Software Path Traversal VulnerabilityEPSS 1.4%CVE-2022-39345CRITICALGin-vue-admin arbitrary file upload vulnerability caused by path traversalEPSS 1.4%