Falhas do tipo CWE-35

184 resultados

Traversal de diretório com sequências de barra dupla não neutralizadas

A aplicação usa entrada do usuário para construir caminhos de arquivo, mas não filtra adequadamente sequências como '.../...//' (barras duplas após pontos). Um atacante explora isso para escapar do diretório permitido e acessar arquivos fora da área restrita, como arquivos de configuração ou dados sensíveis do sistema.

Exemplo

Um servidor web deveria servir arquivos apenas de '/var/www/uploads/', mas não trata '.../...//' corretamente. Um atacante envia '.../...//../etc/passwd' que, após processamento, resolve para '/etc/passwd', contornando a restrição e expondo credenciais do sistema.

Como mitigar

Valide e normalize todos os caminhos com funções seguras da linguagem (como 'realpath()' em PHP ou 'Path.getCanonicalPath()' em Java) e verifique que o caminho final está dentro do diretório permitido usando comparação explícita. Rejeite caracteres perigosos ('..', barra dupla) na entrada antes do processamento.

CVE-2022-3693HIGHPath traversal in FileOrbis File Management SystemEPSS 0.7%CVE-2025-47636HIGHWordPress List category posts plugin <= 0.91.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2025-39598MEDIUMWordPress Administrator Z plugin <= 2025.03.28 - Directory Traversal VulnerabilityEPSS 0.7%CVE-2025-22786HIGHWordPress ElementInvader Addons for Elementor plugin <= 1.2.6 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2023-5800MEDIUMInsufficient input validation in VAPIX API create_overlay.cgiEPSS 0.7%CVE-2025-39470HIGHWordPress Ivy School theme <= 1.6.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2024-56045CRITICALWordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerabilityEPSS 0.7%CVE-2023-21418HIGHSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks EPSS 0.7%CVE-2023-21417HIGHSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversaEPSS 0.7%CVE-2023-21416HIGHSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-ServicEPSS 0.7%CVE-2025-24685HIGHWordPress Morkva UA Shipping plugin <= 1.0.18 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2026-45661CRITICALDokploy: Remote Code Execution through Path TraversalEPSS 0.7%CVE-2025-26935HIGHWordPress WP Job Portal plugin <= 2.2.8 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2025-39475HIGHWordPress Arlo theme <= 6.0.3 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2023-39916CRITICALPossible path traversal when storing RRDP responsesEPSS 0.6%CVE-2024-52498HIGHWordPress SP Blog Designer plugin <= 1.0.0 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2024-41973HIGHWAGO: Remote Arbitrary File Write with Root Privileges in multiple DevicesEPSS 0.6%CVE-2024-52447HIGHWordPress Contact Page With Google Map plugin <= 1.6.1 - Arbitrary File Deletion vulnerabilityEPSS 0.6%CVE-2025-49297HIGHWordPress Grill and Chow theme <= 1.6 - Local File Inclusion VulnerabilityEPSS 0.6%CVE-2025-49295HIGHWordPress MediClinic theme <= 2.1 - Local File Inclusion VulnerabilityEPSS 0.6%