Fallos del tipo CWE-35

174 resultados

Travessia de diretório via sequências de barra dupla

A aplicação constrói caminhos de arquivo a partir de entrada do usuário, mas não neutraliza adequadamente sequências como '.../...//' (barras duplas após pontos). Um atacante pode usar essas sequências mal interpretadas para navegar para fora do diretório restrito e acessar arquivos confidenciais do sistema.

Ejemplo

Um servidor web que deveria servir apenas arquivos de /var/www/uploads, mas aceita requisições como GET /file?path=.../...//.../etc/passwd. Se a normalização de caminhos for incompleta ou implementada ingenuamente, a sequência duplicada pode contornar validações de prefixo, expondo /etc/passwd.

Cómo mitigar

Normalize o caminho completo após construção (usando funções como realpath() em C/PHP ou Path.resolve() em Node.js), valide contra uma lista branca de caracteres permitidos, e sempre verifique se o caminho final está dentro do diretório permitido usando comparação de caminho absoluto resolvido, nunca validações de string simples.

CVE-2023-5885MEDIUMFranklin Electric Fueling Systems Colibri Path TraversalEPSS 1.1%CVE-2024-0113HIGHNVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traverEPSS 1.1%CVE-2025-26352MEDIUMA CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated EPSS 1.0%CVE-2025-59793CRITICALRocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be ableEPSS 1.0%CVE-2026-45495HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-21575CRITICALComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST requestEPSS 1.0%CVE-2025-64676HIGHMicrosoft Purview eDiscovery Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-6252HIGHPath traversal vulnerability in Chameleon Power productsEPSS 0.9%CVE-2024-2654MEDIUMFile Manager <= 7.2.5 - Authenticated (Administrator+) Directory TraversalEPSS 0.9%CVE-2025-26355MEDIUMA CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticateEPSS 0.9%CVE-2026-24464MEDIUMAppliance mode iControl REST vulnerabilityEPSS 0.9%CVE-2025-32585HIGHWordPress Shop Products Filter Plugin <= 1.2 - Local File Inclusion vulnerabilityEPSS 0.9%CVE-2024-45190MEDIUMMage AI pipeline interaction request remote arbitrary file leakEPSS 0.9%CVE-2025-26353MEDIUMA CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote aEPSS 0.8%CVE-2025-26351MEDIUMA CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated EPSS 0.8%CVE-2025-26354HIGHA CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allowsEPSS 0.8%CVE-2025-26356HIGHA CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 aEPSS 0.8%CVE-2024-1886LOWAbsolute path traversal attack on LG SignageEPSS 0.8%CVE-2024-47169HIGHAgnai vulnerable to Remote Code Execution via JS Upload using Directory TraversalEPSS 0.8%CVE-2022-48476HIGHIn JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible EPSS 0.8%