Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2025-15225 Vulnerability in Sunnet (CVE-2025-15225)
CVE-2025-15066 Path Traversal in Innorix WP (CVE-2025-15066)
CVE-2025-15138 Path Traversal in prasathmani TinyFileManager (CVE-2025-15138)
CVE-2025-15076 Path Traversal in Tenda CH22 (CVE-2025-15076)
CVE-2025-68916 Vulnerability in Riello UPS NetMan 208 Application (CVE-2025-68916)
CVE-2025-68476 Path Traversal in KEDA (CVE-2025-68476)
CVE-2025-67442 Path Traversal in EVE-NG (CVE-2025-67442)
CVE-2025-66905 Path Traversal in Takes (CVE-2025-66905)
CVE-2025-68398 Vulnerability in weblate (CVE-2025-68398)
CVE-2025-34452 Path Traversal in Streama (CVE-2025-34452)
CVE-2025-67171 Path Traversal in Ritecms (CVE-2025-67171)
CVE-2025-12496 Path Traversal in Zephyr Project Manager (WordPress plugin) (CVE-2025-12496)
CVE-2025-66449 Path Traversal in ConvertXis a self-hosted online file converter. In (CVE-2025-66449)
CVE-2025-58173 Vulnerability in FreshRSS (CVE-2025-58173)
CVE-2025-60786 Path Traversal in Kagilum (CVE-2025-60786)
CVE-2025-34181 NetSupport Manager < 14.12.0001 contains an arbitrary file write vulnerability in its Connectivity Server/Gateway…
CVE-2025-14704 Path Traversal in Shiguangwu sgwbox N3 (CVE-2025-14704)
CVE-2025-14702 Path Traversal in Smartbit CommV Smartschool App (CVE-2025-14702)
CVE-2025-14699 Path Traversal in Municorn FAX App (CVE-2025-14699)
CVE-2025-14698 Path Traversal in atlaszz AI Photo Team Galleryit App (CVE-2025-14698)
CVE-2025-14617 Path Traversal in Jehovahs Witnesses JW Library App (CVE-2025-14617)
CVE-2025-43463 Path Traversal in Apple macOS (CVE-2025-43463)
CVE-2025-43465 Path Traversal in Apple macOS (CVE-2025-43465)
CVE-2025-67818 Path Traversal in Weaviate OSS (CVE-2025-67818)
CVE-2025-67819 Path Traversal in Weaviate OSS (CVE-2025-67819)
CVE-2025-12960 Path Traversal in Simple CSV Table (WordPress plugin) (CVE-2025-12960)
CVE-2025-13891 Path Traversal in Image Gallery – Photo Grid & Video Gallery (WordPress plugin) (CVE-2025-13891)
CVE-2025-14344 Path Traversal in Multi Uploader for Gravity Forms (WordPress plugin) (CVE-2025-14344)
CVE-2025-13972 Path Traversal in WatchTowerHQ (WordPress plugin) (CVE-2025-13972)
CVE-2025-12824 Path Traversal in Player Leaderboard (WordPress plugin) (CVE-2025-12824)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details