Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,769
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-107716 Path Traversal in banks (CVE-2026-107716)
CVE-2026-19493 Path Traversal in IBM Security Verify Access (CVE-2026-19493)
CVE-2026-84275 Path Traversal in IBM Guardium Data Protection (CVE-2026-84275)
CVE-2026-107377 Path Traversal in datamodel-code-generator (CVE-2026-107377)
CVE-2026-107709 Path Traversal in Bower decompress-zip (CVE-2026-107709)
CVE-2026-19585 Path Traversal in HashiCorp go-getter (CVE-2026-19585)
CVE-2026-102783 Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox...
CVE-2026-107466 Path Traversal in flatpak-builder (CVE-2026-107466)
CVE-2026-85487 Path Traversal in Brocade ASCG (CVE-2026-85487)
CVE-2026-85490 Path Traversal in Broadcom Brocade Active Support Connectivity Gateway (CVE-2026-85490)
CVE-2026-5049 Path Traversal in Brocade SANnav (CVE-2026-5049)
CVE-2026-86828 Path Traversal in BackWPup (WordPress plugin) (CVE-2026-86828)
CVE-2026-94580 Path Traversal in Brocade Fabric OS (CVE-2026-94580)
CVE-2026-105820 Path Traversal in Vault (CVE-2026-105820)
CVE-2026-105816 Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries...
CVE-2026-101886 Path Traversal in Cisco Jabber for Android (CVE-2026-101886)
CVE-2026-106557 Path Traversal in @backstage/plugin-techdocs-node (CVE-2026-106557)
CVE-2026-106108 Path Traversal in @quasar/app-vite (CVE-2026-106108)
CVE-2026-106559 Path Traversal in @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (CVE-2026-106559)
CVE-2026-106560 Path Traversal in @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (CVE-2026-106560)
CVE-2026-102257 Path Traversal in SMA1000 Appliance Management Console (AMC) interface (CVE-2026-102257)
CVE-2026-41958 Path Traversal in VisiData (CVE-2026-41958)
CVE-2026-42532 Path Traversal in VisiData (CVE-2026-42532)
CVE-2026-103435 Claude Code validated that a target file path resided within the project working directory at permission-check time…
CVE-2026-58069 Path Traversal in Veeam Backup & Replication (CVE-2026-58069)
CVE-2026-103870 Path Traversal in pulp-rpm (CVE-2026-103870)
CVE-2026-97671 Path Traversal in Langflow (CVE-2026-97671)
CVE-2026-103360 Path Traversal in Langflow (CVE-2026-103360)
CVE-2026-93448 Path Traversal in Langflow (CVE-2026-93448)
CVE-2026-106508 Path Traversal in @backstage/plugin-techdocs-node (CVE-2026-106508)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details