Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,769
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-110253 Path Traversal in WordPress (CVE-2026-110253)
CVE-2026-110268 Path Traversal in WordPress (CVE-2026-110268)
CVE-2026-111855 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal...
CVE-2026-111854 Path Traversal in SCPI FILESystem command interface (CVE-2026-111854)
CVE-2026-111635 Path Traversal in Helical Insight (CVE-2026-111635)
CVE-2026-111618 Path Traversal in CoAI (CVE-2026-111618)
CVE-2026-41582 Path Traversal in countly-server (CVE-2026-41582)
CVE-2026-42269 Path Traversal in countly-server (CVE-2026-42269)
CVE-2026-107777 Path Traversal in Thermo Fisher Torrent Suite Software (CVE-2026-107777)
CVE-2026-109118 Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause...
CVE-2026-93767 Path Traversal in Tainacan (WordPress plugin) (CVE-2026-93767)
CVE-2026-103896 Path Traversal in WordPress (CVE-2026-103896)
CVE-2026-109221 Path Traversal in Groundhogg — CRM, Newsletters, and Marketing Automation (WordPress plugin) (CVE-2026-109221)
CVE-2026-104769 Path Traversal in Debloat – Remove Unused CSS, Optimize JS (WordPress plugin) (CVE-2026-104769)
CVE-2026-84823 Path Traversal in WildFly (CVE-2026-84823)
CVE-2026-108452 Path Traversal in Microsoft Office SharePoint (CVE-2026-108452)
CVE-2026-105032 The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and...
CVE-2026-111170 Path Traversal in kedro-datasets (CVE-2026-111170)
CVE-2026-85634 Path Traversal in wildfly-core library (CVE-2026-85634)
CVE-2026-78851 Path Traversal in Grav CMS (CVE-2026-78851)
CVE-2026-110746 Path Traversal in TotalAV (CVE-2026-110746)
CVE-2026-104025 Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in...
CVE-2026-61702 Path Traversal in OpenPrinting CUPS (CVE-2026-61702)
CVE-2026-62679 Path Traversal in Lychee (CVE-2026-62679)
CVE-2026-58393 Path Traversal in OPNsense (CVE-2026-58393)
CVE-2026-57155 Path Traversal in OPNsense (CVE-2026-57155)
CVE-2026-63130 Path Traversal in EspoCRM (CVE-2026-63130)
CVE-2026-50619 Path Traversal in Qsirch (CVE-2026-50619)
CVE-2026-26243 Path Traversal in Qsync Central (CVE-2026-26243)
CVE-2026-34015 Path Traversal in Video Station (CVE-2026-34015)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details