Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-18640 Path Traversal in NewNotebook API (CVE-2026-18640)
CVE-2026-72783 Path Traversal in craftcms/cms (CVE-2026-72783)
CVE-2026-72770 Path Traversal in N8N (CVE-2026-72770)
CVE-2026-72773 Path Traversal in N8N (CVE-2026-72773)
CVE-2026-72604 Path Traversal in Intelliants Subrion CMS (CVE-2026-72604)
CVE-2026-72602 Path Traversal in AsyncFuncAI deepwiki-open (CVE-2026-72602)
CVE-2026-33922 A path traversal vulnerability was discovered in the Offline archives functionality of the local...
CVE-2026-66777 Path Traversal in SAP Approuter (CVE-2026-66777)
CVE-2026-44763 SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit...
CVE-2026-73033 Path Traversal in Sucuri Security WordPress plugin through (CVE-2026-73033)
CVE-2026-73030 Path Traversal in unearth (CVE-2026-73030)
CVE-2026-72903 Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can…
CVE-2026-69112 Path Traversal in accelerate (CVE-2026-69112)
CVE-2026-12339 Path Traversal in WebUI ISP Upgrade functionality (CVE-2026-12339)
CVE-2026-47754 Path Traversal in Tomcat (CVE-2026-47754)
CVE-2026-15059 Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path…
CVE-2026-72569 A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an...
CVE-2026-72567 Path Traversal in AsyncFuncAI/deepwiki-open (CVE-2026-72567)
CVE-2026-72571 A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an...
CVE-2026-72572 A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote...
CVE-2026-66484 GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality....
CVE-2026-13170 Path Traversal in Eventin (WordPress plugin) (CVE-2026-13170)
CVE-2026-19372 Path Traversal in Handwriting-OCR handwriting-ocr-mcp-server (CVE-2026-19372)
CVE-2026-19371 Path Traversal in Nikolaibibo claude-comfyui-mcp (CVE-2026-19371)
CVE-2026-19370 Path Traversal in bartekke8it56w2 new-mcp (CVE-2026-19370)
CVE-2026-19368 Path Traversal in PV-Bhat gemsuite-mcp (CVE-2026-19368)
CVE-2026-19366 Path Traversal in NocteDefensor LudusMCP (CVE-2026-19366)
CVE-2026-19365 Path Traversal in Ichigo3766 image-gen-mcp (CVE-2026-19365)
CVE-2026-19338 Path Traversal in automateyournetwork MCPyATS (CVE-2026-19338)
CVE-2026-19335 Path Traversal in Jane-xiaoer skill-vision-control (CVE-2026-19335)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details