Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,778

Image ID Title
CVE-2026-65700 Path Traversal in h2oGPT (CVE-2026-65700)
CVE-2026-65701 SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal...
CVE-2026-65702 Path Traversal in Vanna (CVE-2026-65702)
CVE-2026-65698 Path Traversal in Void (CVE-2026-65698)
CVE-2026-65695 Path Traversal in Office-Word-MCP-Server (CVE-2026-65695)
CVE-2026-65687 Path Traversal in Bold Reports Standalone Report Designer (CVE-2026-65687)
CVE-2026-65688 Path Traversal in Bold Reports Standalone Report Designer (CVE-2026-65688)
CVE-2026-65689 Path Traversal in Bold Reports Standalone Report Designer (CVE-2026-65689)
CVE-2026-65690 Path Traversal in Bold Reports Standalone Report Designer (CVE-2026-65690)
CVE-2026-45623 Path Traversal in postcss (CVE-2026-45623)
CVE-2026-65607 Path Traversal in SiYuan (CVE-2026-65607)
CVE-2026-59555 Path Traversal in Participants Database (CVE-2026-59555)
CVE-2026-59542 Path Traversal in Kali Forms (CVE-2026-59542)
CVE-2026-57696 Path Traversal in Picture Gallery (CVE-2026-57696)
CVE-2026-57716 Path Traversal in Broadcast Live Video (CVE-2026-57716)
CVE-2026-65754 ReReplacer XML include paths could read files outside the site directory.
CVE-2026-65713 Modals gallery paths could enumerate unintended directories.
CVE-2026-15786 Path Traversal in WordPress (CVE-2026-15786)
CVE-2026-65431 Geo IP database update archives have been broadly extracted without path validation, leading to...
CVE-2026-16078 Path Traversal in WordPress (CVE-2026-16078)
CVE-2026-64872 Custom purge and log paths could escape the site webroot directory.
CVE-2026-65712 CDN versioning could check file paths outside the site directory, exposing local file existence...
CVE-2026-15074 Path Traversal in @fastify/static (CVE-2026-15074)
CVE-2026-16653 Path Traversal in boazsegev facil.io (CVE-2026-16653)
CVE-2026-14985 Path Traversal in Analog Way Picturall Quad Compact Mark II (CVE-2026-14985)
CVE-2026-13186 Path Traversal in Progress Telerik Ui For Aspnet Ajax (CVE-2026-13186)
CVE-2026-65600 Path Traversal in github.com/traefik/traefik/v2 (CVE-2026-65600)
CVE-2026-44192 Path Traversal in Ansible Lightspeed Model Context Protocol (MCP) server (CVE-2026-44192)
CVE-2026-56844 Path Traversal in Veeam Software Appliance (CVE-2026-56844)
CVE-2026-30633 Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details