Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-105676 Path Traversal in ghost (CVE-2026-105676)
CVE-2026-12171 Path Traversal in auto-changelog (CVE-2026-12171)
CVE-2026-88396 Path Traversal in ApiAdmin (CVE-2026-88396)
CVE-2026-89039 The convert_playwright_script prompt in the k6 MCP server accepts a file path as its...
CVE-2026-88392 Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an...
CVE-2026-88394 Path Traversal in WookTeam (CVE-2026-88394)
CVE-2026-63266 LibreOffice Calc can link a cell range to an external data source, and the link is saved in the...
CVE-2026-105286 Path Traversal in Totolink A3002MU (CVE-2026-105286)
CVE-2026-104805 DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows...
CVE-2026-105293 Path Traversal in Legcord (CVE-2026-105293)
CVE-2026-105174 Path Traversal in Gerapy (CVE-2026-105174)
CVE-2026-105157 Path Traversal in RainyGao DocSys (CVE-2026-105157)
CVE-2026-105144 Path Traversal in Drogon (CVE-2026-105144)
CVE-2026-105125 Path Traversal in LaraDashboard (CVE-2026-105125)
CVE-2026-104983 Path Traversal in Linux Mint Xreader (CVE-2026-104983)
CVE-2026-76431 Path Traversal in Cisco Identity Services Engine (CVE-2026-76431)
CVE-2026-104982 Path Traversal in Linux Mint Xreader (CVE-2026-104982)
CVE-2026-87115 Path Traversal in VikAppointments Services Booking Calendar (WordPress plugin) (CVE-2026-87115)
CVE-2026-94238 Path Traversal in Loco Translate (WordPress plugin) (CVE-2026-94238)
CVE-2026-85015 Path Traversal in Unlimited Elements for Elementor (WordPress plugin) (CVE-2026-85015)
CVE-2026-103293 Path Traversal in MPG (WordPress plugin) (CVE-2026-103293)
CVE-2026-104478 Path Traversal in Formwork (CVE-2026-104478)
CVE-2026-104871 Path Traversal in @angular/ssr (CVE-2026-104871)
CVE-2014-125130 Path Traversal in WordPress (CVE-2014-125130)
CVE-2026-104853 Path Traversal in nx (CVE-2026-104853)
CVE-2026-51906 Path Traversal in TaskingAI (CVE-2026-51906)
CVE-2026-51907 Path Traversal in TaskingAI (CVE-2026-51907)
CVE-2026-104843 Path Traversal in uv (CVE-2026-104843)
CVE-2026-103648 Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to...
CVE-2026-104721 Path Traversal in Logback-classic (CVE-2026-104721)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details