Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,778

Image ID Title
CVE-2026-69095 OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path...
CVE-2026-69086 Path Traversal in github.com/siyuan-note/siyuan/kernel (CVE-2026-69086)
CVE-2026-69089 Path Traversal in getgrav/grav (CVE-2026-69089)
CVE-2025-15673 Path Traversal in WordPress Import (CVE-2025-15673)
CVE-2026-9856 Path Traversal in transformers (CVE-2026-9856)
CVE-2026-9335 Path Traversal in keras (CVE-2026-9335)
CVE-2026-13339 Path Traversal in CubeWP Framework (WordPress plugin) (CVE-2026-13339)
CVE-2026-18352 Path Traversal in WordPress (CVE-2026-18352)
CVE-2026-67309 Path Traversal in github.com/traefik/traefik/v3 (CVE-2026-67309)
CVE-2026-67295 Path Traversal in FreeRDP (CVE-2026-67295)
CVE-2026-15601 Path Traversal in WordPress (CVE-2026-15601)
CVE-2026-15450 Path Traversal in Nex Forms – Ultimate Form Builder – Lite (WordPress plugin) (CVE-2026-15450)
CVE-2026-15244 Path Traversal in HUSKY (WordPress plugin) (CVE-2026-15244)
CVE-2026-15932 Path Traversal in Support Genix (WordPress plugin) (CVE-2026-15932)
CVE-2026-15006 Path Traversal in WordPress (CVE-2026-15006)
CVE-2026-54785 Information Disclosure in gemini-bridge (CVE-2026-54785)
CVE-2026-62999 Path Traversal in Copier (CVE-2026-62999)
CVE-2026-55825 Path Traversal in contao/contao (CVE-2026-55825)
CVE-2026-53502 Path Traversal in thumbor (CVE-2026-53502)
CVE-2026-62391 Path Traversal in Apache (CVE-2026-62391)
CVE-2026-44615 Path Traversal in Apache (CVE-2026-44615)
CVE-2026-63222 Path Traversal in codeigniter4/framework (CVE-2026-63222)
CVE-2026-56673 Path Traversal in ComfyUI (CVE-2026-56673)
CVE-2026-56671 Path Traversal in ComfyUI (CVE-2026-56671)
CVE-2026-66755 Path Traversal in Apache (CVE-2026-66755)
CVE-2026-12942 Path Traversal in Langflow (CVE-2026-12942)
CVE-2026-52680 Path Traversal in Apache (CVE-2026-52680)
CVE-2026-62663 Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media…
CVE-2026-6540 Path Traversal in Calico (CVE-2026-6540)
CVE-2026-14519 Path Traversal in IBM App Connect Enterprise (CVE-2026-14519)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details