Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-52875 Path Traversal in Streambert (CVE-2026-52875)
CVE-2026-52872 Path Traversal in Streambert (CVE-2026-52872)
CVE-2026-50186 Path Traversal in 4gaBoards (CVE-2026-50186)
CVE-2026-47699 Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From…
CVE-2026-73974 Path Traversal in linuxfabrik-lib (CVE-2026-73974)
CVE-2026-53457 Path Traversal in Blueprint Studio (CVE-2026-53457)
CVE-2026-55224 Path Traversal in mineadmin/mineadmin (CVE-2026-55224)
CVE-2026-47627 Path Traversal in NVIDIA Triton Inference Server for Linux (CVE-2026-47627)
CVE-2026-52607 A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose...
CVE-2026-52610 An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote...
CVE-2026-74038 Path Traversal in Wazuh (CVE-2026-74038)
CVE-2026-74044 Path Traversal in Wazuh (CVE-2026-74044)
CVE-2026-68922 Path Traversal in mobsf (CVE-2026-68922)
CVE-2026-63328 Path Traversal in github.com/aquasecurity/trivy (CVE-2026-63328)
CVE-2026-75914 Path Traversal in deepseek-tui (CVE-2026-75914)
CVE-2026-75859 Path Traversal in deepseek-tui (CVE-2026-75859)
CVE-2026-73383 Path Traversal in CTX Feed (CVE-2026-73383)
CVE-2026-73181 Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6...
CVE-2026-45532 Path Traversal in DataEase (CVE-2026-45532)
CVE-2026-75842 Path Traversal in ArcadeDB (CVE-2026-75842)
CVE-2026-75855 Path Traversal in ArcadeDB (CVE-2026-75855)
CVE-2026-74907 Path Traversal in getgrav/grav (CVE-2026-74907)
CVE-2026-15585 Path Traversal in AKINSOFT Wolvox9 ERP / KontrolPanel.exe (CVE-2026-15585)
CVE-2026-42162 Path Traversal in Mahara (CVE-2026-42162)
CVE-2026-67918 Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain...
CVE-2026-75111 Path Traversal in Evidently UI (CVE-2026-75111)
CVE-2026-75482 Path Traversal in SWE-agent (CVE-2026-75482)
CVE-2026-75104 Path Traversal in Hugging Face Transformers (CVE-2026-75104)
CVE-2026-54336 Path Traversal in JumpServer (CVE-2026-54336)
CVE-2026-40506 Path Traversal in OpenEMR (CVE-2026-40506)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details