Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-90691 Path Traversal in 0x4m4 HexStrike AI (CVE-2026-90691)
CVE-2026-90774 Path Traversal in rustypaste (CVE-2026-90774)
CVE-2026-90494 Path Traversal in restify node-restify (CVE-2026-90494)
CVE-2026-90445 An interface that accepts file uploads from authenticated users extracts the contents of uploaded...
CVE-2026-49846 libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP…
CVE-2025-69904 Path Traversal in Linkstack (CVE-2025-69904)
CVE-2026-87910 When tarfile extracts a link on a system that doesn't support links, it falls back to extracting...
CVE-2026-87983 Path Traversal in Mistral Vibe (CVE-2026-87983)
CVE-2026-87984 Path Traversal in Mistral Vibe (CVE-2026-87984)
CVE-2026-87727 a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an...
CVE-2026-19991 Path Traversal in UsersWP (WordPress plugin) (CVE-2026-19991)
CVE-2026-77807 Path Traversal in WordPress (CVE-2026-77807)
CVE-2026-85706 KEV [KEV] Path Traversal in Gitlab (CVE-2026-85706)
CVE-2026-82100 Path Traversal in IBM DataStage on Cloud Pak for Data (CVE-2026-82100)
CVE-2026-84889 Path Traversal in Langflow (CVE-2026-84889)
CVE-2026-86087 Path Traversal in IBM Db2 (CVE-2026-86087)
CVE-2026-81540 Path Traversal in IBM DataStage on Cloud Pak for Data (CVE-2026-81540)
CVE-2026-81551 Path Traversal in IBM DataStage on Cloud Pak for Data (CVE-2026-81551)
CVE-2026-81554 Path Traversal in IBM DataStage on Cloud Pak for Data (CVE-2026-81554)
CVE-2026-80424 Path Traversal in IBM DataStage on Cloud Pak for Data (CVE-2026-80424)
CVE-2026-45767 Path Traversal in Suricata (CVE-2026-45767)
CVE-2025-57231 Path Traversal in Docmost (CVE-2025-57231)
CVE-2026-76652 An authenticated directory traversal vulnerability in file upload functionality has been...
CVE-2026-88046 Path Traversal in github.com/rclone/rclone (CVE-2026-88046)
CVE-2026-88937 Path Traversal in knowns (CVE-2026-88937)
CVE-2026-88938 Path Traversal in knowns (CVE-2026-88938)
CVE-2026-88940 Path Traversal in knowns (CVE-2026-88940)
CVE-2026-88014 Path Traversal in github.com/rclone/rclone (CVE-2026-88014)
CVE-2026-81789 Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce <= 3...
CVE-2026-81275 Path Traversal in Youzify (CVE-2026-81275)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details