Falhas do tipo CWE-36

144 resultados

Traversal de Diretório via Caminho Absoluto

A aplicação usa entrada do usuário para construir caminhos de arquivo, mas não valida se o resultado aponta para fora do diretório permitido. Um atacante injeta caminhos absolutos (como /etc/passwd) que ignoram as restrições de diretório, acessando arquivos sensíveis do sistema.

Exemplo

Um servidor web recebe ?file=../../../etc/passwd ou file=/etc/passwd e o código concatena direto em open('/uploads/' + file) sem verificar se o caminho resultante está realmente dentro de /uploads/, expondo dados confidenciais.

Como mitigar

Valide e normalize o caminho com funções seguras (realpath, Path.resolve), rejeite caminhos absolutos e sequências de traversal (..), e use listas brancas de arquivos permitidos. Garanta que o caminho final está dentro do diretório esperado antes de abrir o arquivo.

CVE-2026-26337HIGHHyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRFEPSS 0.4%CVE-2026-47243CRITICALKata guest escape: runtime-rs guest-root to host-root escape via virtiofsEPSS 0.4%CVE-2026-68896HIGHMicrosoft Windows Search Component Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-15236MEDIUMQuanta Computer｜QOCA aim AI Medical Cloud Platform - Path TraversalEPSS 0.3%CVE-2025-15237MEDIUMQuanta Computer｜QOCA aim AI Medical Cloud Platform - Path TraversalEPSS 0.3%CVE-2026-69612HIGHWindows Error Reporting Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-12643HIGHChunghwa Telecom tbm-client - Arbitrary File DeleteEPSS 0.3%CVE-2026-53698MEDIUMSilverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.EPSS 0.3%CVE-2024-12646HIGHChunghwa Telecom topm-client - Arbitrary File DeleteEPSS 0.3%CVE-2026-27117MEDIUMbit7z has a path traversal vulnerabilityEPSS 0.3%CVE-2026-54202HIGHTeamDavid: Path Traversal in the archive creation functionalityEPSS 0.3%CVE-2024-12644HIGHChunghwa Telecom tbm-client - Arbitrary File Copy and PasteEPSS 0.3%CVE-2026-13346MEDIUMpip absolute path traversal during download from malicious package indexesEPSS 0.3%CVE-2024-57966MEDIUMlibarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.EPSS 0.3%CVE-2025-13282HIGHChunghwa Telecom｜TenderDocTransfer - Arbitrary File DeleteEPSS 0.3%CVE-2021-34711MEDIUMCisco IP Phone Software Arbitrary File Read VulnerabilityEPSS 0.3%CVE-2025-67898MEDIUMMJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. NOTE: this issue eEPSS 0.3%CVE-2025-13283HIGHChunghwa Telecom｜TenderDocTransfer - Arbitrary File Copy and PasteEPSS 0.2%CVE-2023-40597HIGHAbsolute Path Traversal in Splunk Enterprise Using runshellscript.pyEPSS 0.2%CVE-2026-46345HIGHcompliance-trestle - jinja has an Arbitrary File Write via Path TraversalEPSS 0.2%