Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-41544 Path Traversal in QcalAgent (CVE-2026-41544)
CVE-2026-24718 Path Traversal in Qsync Central (CVE-2026-24718)
CVE-2025-66272 Path Traversal in Video Station (CVE-2025-66272)
CVE-2025-66275 Path Traversal in Video Station (CVE-2025-66275)
CVE-2026-110923 Path Traversal in OpenSSH (CVE-2026-110923)
CVE-2026-0312 Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an...
CVE-2026-110666 Path Traversal in cemtan sar2html (CVE-2026-110666)
CVE-2026-110766 Path Traversal in Colanode server (CVE-2026-110766)
CVE-2026-62664 Path Traversal in FileRise (CVE-2026-62664)
CVE-2026-104107 FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise…
CVE-2026-100406 dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to…
CVE-2026-110717 Path Traversal in Janus WebRTC Server (CVE-2026-110717)
CVE-2026-110657 Path Traversal in Khronos NNEF-Tools nnef (CVE-2026-110657)
CVE-2026-104103 Path Traversal in Ludwig (CVE-2026-104103)
CVE-2026-92153 F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software…
CVE-2026-101217 Path Traversal in Dell Unisphere for PowerMax vApp (CVE-2026-101217)
CVE-2026-59774 Path Traversal in Gitea (CVE-2026-59774)
CVE-2026-107508 Path Traversal in Ultimate Multisite (WordPress plugin) (CVE-2026-107508)
CVE-2026-110458 A malicious actor with access to the network and under certain conditions could exploit a Path...
CVE-2026-110457 A malicious actor with access to the network and under certain conditions could exploit a Path...
CVE-2026-53564 Path Traversal in UniconOS (CVE-2026-53564)
CVE-2026-103820 Path Traversal in CAI Content Credential (CVE-2026-103820)
CVE-2026-63162 Path Traversal in Omnispace Agora Project (CVE-2026-63162)
CVE-2026-90530 Path Traversal in ColdFusion RDS (CVE-2026-90530)
CVE-2026-79715 Path Traversal in IBM WebSphere Application Server - Liberty (CVE-2026-79715)
CVE-2026-106634 Path Traversal in Adobe Experience Manager (CVE-2026-106634)
CVE-2026-102238 Path Traversal in Microsoft Visual Studio Code (CVE-2026-102238)
CVE-2026-85932 Path Traversal in Microsoft Sharepoint Server (CVE-2026-85932)
CVE-2026-70298 Path Traversal in Microsoft Sharepoint Server (CVE-2026-70298)
CVE-2026-70161 Path Traversal in Microsoft (CVE-2026-70161)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details