Falhas do tipo CWE-73
768 resultadosControle de acesso inadequado
A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.
Exemplo
Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.
Como mitigar
Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.
CVE-2026-25628HIGHQdrant affected by arbitrary file write via `/logger` endpointEPSS 0.5%CVE-2023-0008MEDIUMPAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web InterfaceEPSS 0.5%CVE-2026-54583HIGHmport package bundle downloads allow unsafe destination filenamesEPSS 0.5%CVE-2025-54945CRITICALSUNNET Corporate Training Management System - External Control of File Name or PathEPSS 0.5%CVE-2026-107377HIGHdatamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directoryEPSS 0.5%CVE-2026-79426HIGHAn arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to dEPSS 0.5%CVE-2025-64714MEDIUMPrivateBin's template-switching feature allows arbitrary local file inclusion through path traversalEPSS 0.5%CVE-2025-13380MEDIUMAI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File ReadEPSS 0.5%CVE-2026-15724HIGHPath traversal in Progress ShareFile Storage Zones Controller (SZC)EPSS 0.5%CVE-2026-34783HIGHFerret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websitesEPSS 0.5%CVE-2026-15983HIGHSuper Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' ParameterEPSS 0.5%CVE-2024-9575HIGHLocal File Inclusion in pretix-widget WordPress pluginEPSS 0.5%CVE-2026-76158CRITICALDatiphy Data Management Center - External Control of File Name or PathEPSS 0.5%CVE-2026-53580HIGHTrilium arbitrary file read and denial of service via file:// URLs in the automatic image-download featureEPSS 0.5%CVE-2026-73171HIGHNozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKEPSS 0.5%CVE-2025-54162MEDIUMFile Station 5EPSS 0.5%CVE-2026-6205HIGHAn external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280EPSS 0.5%CVE-2023-5816MEDIUMCode Explorer <= 1.4.5 - Authenticated (Admin+) External File ReadingEPSS 0.5%CVE-2026-39006CRITICALAn issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.EPSS 0.5%CVE-2026-103507HIGHArbitrary file-write via log configuration path in P4SearchEPSS 0.5%