Falhas do tipo CWE-36

130 resultados

Traversal de Diretório via Caminho Absoluto

A aplicação usa entrada do usuário para construir caminhos de arquivo, mas não valida se o resultado aponta para fora do diretório permitido. Um atacante injeta caminhos absolutos (como /etc/passwd) que ignoram as restrições de diretório, acessando arquivos sensíveis do sistema.

Exemplo

Um servidor web recebe ?file=../../../etc/passwd ou file=/etc/passwd e o código concatena direto em open('/uploads/' + file) sem verificar se o caminho resultante está realmente dentro de /uploads/, expondo dados confidenciais.

Como mitigar

Valide e normalize o caminho com funções seguras (realpath, Path.resolve), rejeite caminhos absolutos e sequências de traversal (..), e use listas brancas de arquivos permitidos. Garanta que o caminho final está dentro do diretório esperado antes de abrir o arquivo.

CVE-2024-20401CRITICALA vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote EPSS 2.3%CVE-2023-2765MEDIUMWeaver OA downfile.php absolute path traversalEPSS 2.2%CVE-2024-6250HIGHAbsolute Path Traversal in parisneo/lollms-webuiEPSS 2.0%CVE-2025-53392MEDIUMIn Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directEPSS 1.8%CVE-2024-47883CRITICALButterfly has path/URL confusion in resource handling leading to multiple weaknessesEPSS 1.6%CVE-2023-34135—Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlyiEPSS 1.6%CVE-2017-7929—An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has EPSS 1.5%CVE-2021-1617MEDIUMCisco Intersight Virtual Appliance VulnerabilitiesEPSS 1.5%CVE-2022-20791MEDIUMCisco Unified Communications Products Arbitrary File Read VulnerabilityEPSS 1.4%CVE-2022-1554MEDIUMPath Traversal due to `send_file` call in clinical-genomics/scoutEPSS 1.3%CVE-2021-32507MEDIUMQSAN Storage Manager - Absolute Path Traversal via FileDownload functionEPSS 1.3%CVE-2021-32506MEDIUMQSAN Storage Manager - Absolute Path Traversal via GetImage functionEPSS 1.3%CVE-2021-30173MEDIUMJun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File InclusionEPSS 1.2%CVE-2024-2362CRITICALPath Traversal in parisneo/lollms-webuiEPSS 1.1%CVE-2022-24877CRITICALImproper path handling in kustomization files allows path traversalEPSS 1.1%CVE-2024-10047MEDIUMDirectory Listing Vulnerability in parisneo/lollms-webuiEPSS 1.0%CVE-2022-20958HIGHA vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacEPSS 0.9%CVE-2024-8501HIGHArbitrary File Download in modelscope/agentscopeEPSS 0.9%CVE-2023-32054HIGHVolume Shadow Copy Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2024-4881HIGHPath Traversal in parisneo/lollmsEPSS 0.9%