Falhas do tipo CWE-36

144 resultados

Traversal de Diretório via Caminho Absoluto

A aplicação usa entrada do usuário para construir caminhos de arquivo, mas não valida se o resultado aponta para fora do diretório permitido. Um atacante injeta caminhos absolutos (como /etc/passwd) que ignoram as restrições de diretório, acessando arquivos sensíveis do sistema.

Exemplo

Um servidor web recebe ?file=../../../etc/passwd ou file=/etc/passwd e o código concatena direto em open('/uploads/' + file) sem verificar se o caminho resultante está realmente dentro de /uploads/, expondo dados confidenciais.

Como mitigar

Valide e normalize o caminho com funções seguras (realpath, Path.resolve), rejeite caminhos absolutos e sequências de traversal (..), e use listas brancas de arquivos permitidos. Garanta que o caminho final está dentro do diretório esperado antes de abrir o arquivo.

CVE-2025-36574HIGHDell Wyse Management Suite, versions prior to WMS 5.2, contain an Absolute Path Traversal vulnerability. An unauthenticated attacker with reEPSS 0.5%CVE-2025-14253MEDIUMGalaxy Software Services｜Vitals ESP - Arbitrary File ReadEPSS 0.5%CVE-2026-4782MEDIUMAvada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode ParameterEPSS 0.5%CVE-2024-48850HIGHAuthenticated Absolute Path TraversalEPSS 0.5%CVE-2025-53079MEDIUMAbsolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive filesEPSS 0.5%CVE-2026-2753HIGHAn Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize usEPSS 0.5%CVE-2026-61891HIGHIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GEEPSS 0.5%CVE-2026-58300MEDIUMMicrosoft Edge for Android Information Disclosure VulnerabilityEPSS 0.4%CVE-2025-53651MEDIUMJenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTMEPSS 0.4%CVE-2026-7217MEDIUMDeepractice PromptX Document File index.ts read_pdf absolute path traversalEPSS 0.4%CVE-2026-35465HIGHSecureDrop Client has path injection in read_gzip_header_filename()EPSS 0.4%CVE-2026-34515MEDIUMAIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on WindowsEPSS 0.4%CVE-2025-9516MEDIUMatec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File ReadEPSS 0.4%CVE-2026-0846HIGHArbitrary File Read via Absolute Path Input in nltk.util.filestring()EPSS 0.4%CVE-2024-13945HIGHStored Absolute Path TraversalEPSS 0.4%CVE-2026-68487CRITICALPath traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.EPSS 0.4%CVE-2026-4373HIGHJetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media FieldEPSS 0.4%CVE-2026-42315HIGHpyLoad: Path Traversal via Package Folder Name in set_package_dataEPSS 0.4%CVE-2026-10075MEDIUMInterinfo｜DreamMaker - Path TraversalEPSS 0.4%CVE-2026-88288MEDIUMGV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink CreationEPSS 0.4%