Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,769
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-51860 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in…
CVE-2026-51570 modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.
CVE-2026-51853 agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in…
CVE-2026-51852 agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers...
CVE-2026-51859 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file…
CVE-2026-51568 modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
CVE-2026-102123 Path Traversal in Accellion Kiteworks (CVE-2026-102123)
CVE-2026-102119 Path Traversal in Accellion Kiteworks (CVE-2026-102119)
CVE-2026-102116 Path Traversal in Accellion Kiteworks (CVE-2026-102116)
CVE-2026-102097 Path Traversal in Accellion Kiteworks (CVE-2026-102097)
CVE-2026-102099 Path Traversal in Accellion Kiteworks (CVE-2026-102099)
CVE-2026-102089 Path Traversal in Accellion Kiteworks (CVE-2026-102089)
CVE-2023-54403 Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows…
CVE-2024-58387 Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint…
CVE-2026-102991 Path Traversal in Mako (CVE-2026-102991)
CVE-2026-101885 ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin…
CVE-2026-101295 Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator…
CVE-2026-97242 Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.
CVE-2026-96824 Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.
CVE-2026-94123 Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
CVE-2026-75098 Path Traversal in WordPress (CVE-2026-75098)
CVE-2026-102457 EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit…
CVE-2026-102843 A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8…
CVE-2026-86136 Path Traversal in Watchguard Fireware (CVE-2026-86136)
CVE-2026-86105 Path Traversal in Watchguard Fireware (CVE-2026-86105)
CVE-2026-13224 Path Traversal in Watchguard Fireware (CVE-2026-13224)
CVE-2026-103044 XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension…
CVE-2026-76737 An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On…
CVE-2026-79534 mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in…
CVE-2026-102875 VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate…

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details