Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2026-19722 Path Traversal in WPvivid — Backup, Migration & Staging (WordPress plugin) (CVE-2026-19722)
CVE-2026-82460 Path Traversal in Cloud Commander (CVE-2026-82460)
CVE-2026-18899 Path Traversal in Langflow (CVE-2026-18899)
CVE-2026-82286 Path Traversal in gpt-crawler (CVE-2026-82286)
CVE-2026-82275 Path Traversal in Qwen-Agent (CVE-2026-82275)
CVE-2026-82264 Path Traversal in Duplicacy (CVE-2026-82264)
CVE-2026-55552 Path Traversal in org.yamcs:yamcs-core (CVE-2026-55552)
CVE-2026-55569 Path Traversal in github.com/aquaproj/aqua/v2 (CVE-2026-55569)
CVE-2026-82112 Path Traversal in houtini-ai houtini-lm (CVE-2026-82112)
CVE-2026-38093 file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to...
CVE-2026-82253 gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal...
CVE-2026-82251 Path Traversal in gitoxide (CVE-2026-82251)
CVE-2026-82111 Path Traversal in iswalle getnote-mcp (CVE-2026-82111)
CVE-2026-82233 Path Traversal in SiYuan (CVE-2026-82233)
CVE-2026-61800 Path Traversal in Wazuh (CVE-2026-61800)
CVE-2026-81847 Path Traversal in MAA-AI MaaMCP (CVE-2026-81847)
CVE-2026-75418 Path Traversal in Lektor (CVE-2026-75418)
CVE-2026-81837 Path Traversal in RooCodeInc Roo-Code (CVE-2026-81837)
CVE-2026-81845 Path Traversal in arben-adm mcp-sequential-thinking (CVE-2026-81845)
CVE-2026-75337 The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to...
CVE-2026-54083 Path Traversal in Wazuh (CVE-2026-54083)
CVE-2026-81730 Path Traversal in Dolibarr (CVE-2026-81730)
CVE-2026-76639 Path Traversal in Unitree G1 EDU firmware (CVE-2026-76639)
CVE-2026-59294 Path Traversal in Vmware Spring Ai (CVE-2026-59294)
CVE-2026-37066 Path Traversal in Veno File Manager Project (CVE-2026-37066)
CVE-2026-37068 Path Traversal in Veno File Manager Project (CVE-2026-37068)
CVE-2026-37007 A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to...
CVE-2026-54732 Path Traversal in libreoffice-convert (CVE-2026-54732)
CVE-2026-81716 Path Traversal in openssl_encrypt (CVE-2026-81716)
CVE-2026-79653 Path Traversal in Eclipse SW360 (CVE-2026-79653)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details