Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,769
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-78394 Path Traversal in Link Library (WordPress plugin) (CVE-2026-78394)
CVE-2026-82708 The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server...
CVE-2026-97365 Path Traversal in chonkie-inc littrs (CVE-2026-97365)
CVE-2026-97323 Path Traversal in YunaiV/zhijiantianya ruoyi-vue-pro (CVE-2026-97323)
CVE-2026-48070 Path Traversal in Docmost (CVE-2026-48070)
CVE-2026-48072 Path Traversal in Docmost (CVE-2026-48072)
CVE-2026-97232 Path Traversal in volotat Anagnorisis (CVE-2026-97232)
CVE-2026-91123 Path Traversal in Discourse (CVE-2026-91123)
CVE-2026-97226 Path Traversal in DbGate (CVE-2026-97226)
CVE-2026-90959 A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url'...
CVE-2026-82094 Path Traversal in IBM DataStage on Cloud Pak for Data (CVE-2026-82094)
CVE-2026-81547 Path Traversal in IBM DataStage on Cloud Pak for Data (CVE-2026-81547)
CVE-2026-77825 Path Traversal in IBM ContextForge MCP Gateway (CVE-2026-77825)
CVE-2026-19532 Path Traversal in Liman MYS (CVE-2026-19532)
CVE-2026-78312 Path Traversal in DIAEnergie (CVE-2026-78312)
CVE-2026-77193 Path Traversal in eesy_ID2WP – Publish InDesign HTML5 (WordPress plugin) (CVE-2026-77193)
CVE-2026-82077 Path Traversal in PaperCut NG (CVE-2026-82077)
CVE-2026-88843 Path Traversal in MasterStudy LMS WordPress Plugin (WordPress plugin) (CVE-2026-88843)
CVE-2026-96898 Path Traversal in yhx070424 ShopXO (CVE-2026-96898)
CVE-2026-96884 Path Traversal in MantisZip (CVE-2026-96884)
CVE-2026-96678 Path Traversal in weiqingwen spring-boot-forum (CVE-2026-96678)
CVE-2026-75887 Path Traversal in OpenShift console (CVE-2026-75887)
CVE-2026-6925 Path Traversal in IBM Concert (CVE-2026-6925)
CVE-2026-67224 Path Traversal in RabbitMQ (CVE-2026-67224)
CVE-2026-95525 Path Traversal in WP User Frontend (CVE-2026-95525)
CVE-2026-96651 Path Traversal in Plex Media Server (CVE-2026-96651)
CVE-2026-79304 Path Traversal in CyberPanel (CVE-2026-79304)
CVE-2026-79306 Path Traversal in CyberPanel (CVE-2026-79306)
CVE-2026-96275 A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host…
CVE-2026-96276 If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak…

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details