Fallos del tipo CWE-35

172 resultados

Travessia de diretório via sequências de barra dupla

A aplicação constrói caminhos de arquivo a partir de entrada do usuário, mas não neutraliza adequadamente sequências como '.../...//' (barras duplas após pontos). Um atacante pode usar essas sequências mal interpretadas para navegar para fora do diretório restrito e acessar arquivos confidenciais do sistema.

Ejemplo

Um servidor web que deveria servir apenas arquivos de /var/www/uploads, mas aceita requisições como GET /file?path=.../...//.../etc/passwd. Se a normalização de caminhos for incompleta ou implementada ingenuamente, a sequência duplicada pode contornar validações de prefixo, expondo /etc/passwd.

Cómo mitigar

Normalize o caminho completo após construção (usando funções como realpath() em C/PHP ou Path.resolve() em Node.js), valide contra uma lista branca de caracteres permitidos, e sempre verifique se o caminho final está dentro do diretório permitido usando comparação de caminho absoluto resolvido, nunca validações de string simples.

CVE-2023-21418HIGHSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks EPSS 0.7%CVE-2023-21416HIGHSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-ServicEPSS 0.7%CVE-2025-39598MEDIUMWordPress Administrator Z plugin <= 2025.03.28 - Directory Traversal VulnerabilityEPSS 0.7%CVE-2026-45661CRITICALDokploy: Remote Code Execution through Path TraversalEPSS 0.7%CVE-2025-39470HIGHWordPress Ivy School theme <= 1.6.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2025-24685HIGHWordPress Morkva UA Shipping plugin <= 1.0.18 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2025-47636HIGHWordPress List category posts plugin <= 0.91.0 - Local File Inclusion VulnerabilityEPSS 0.6%CVE-2025-47176HIGHMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-26935HIGHWordPress WP Job Portal plugin <= 2.2.8 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2024-52498HIGHWordPress SP Blog Designer plugin <= 1.0.0 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2025-27010HIGHWordPress Tastyc < 2.5.2 - Local File Inclusion VulnerabilityEPSS 0.6%CVE-2024-41973HIGHWAGO: Remote Arbitrary File Write with Root Privileges in multiple DevicesEPSS 0.6%CVE-2024-52447HIGHWordPress Contact Page With Google Map plugin <= 1.6.1 - Arbitrary File Deletion vulnerabilityEPSS 0.6%CVE-2023-21415MEDIUMSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacksEPSS 0.6%CVE-2024-41972MEDIUMWAGO: Arbitrary File Overwrite Leading to Privileged File Read in Multiple DevicesEPSS 0.6%CVE-2024-56213MEDIUMWordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerabilityEPSS 0.6%CVE-2025-39467HIGHWordPress Wanderland theme <= 1.7.1 - Local File Inclusion VulnerabilityEPSS 0.6%CVE-2026-6074CRITICALPath traversal: '.../...//' in Intrado 911 Emergency Gateway (EGW)EPSS 0.6%CVE-2025-39475HIGHWordPress Arlo theme <= 6.0.3 - Local File Inclusion VulnerabilityEPSS 0.6%CVE-2023-39916CRITICALPossible path traversal when storing RRDP responsesEPSS 0.5%