Cwe 22 (page 8) — Tags

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。

📌 Example

CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。

🛡 Vulnerabilities tagged with this 2,773

ID	Title	Severity	Detected
CVE-2026-105676	Path Traversal in ghost (CVE-2026-105676)	Medium	1 week ago
CVE-2026-12171	Path Traversal in auto-changelog (CVE-2026-12171)	High	1 week ago
CVE-2026-88396	Path Traversal in ApiAdmin (CVE-2026-88396)	High	1 week ago
CVE-2026-89039	The convert_playwright_script prompt in the k6 MCP server accepts a file path as its...	Medium	1 week ago
CVE-2026-88392	Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an...	High	1 week ago
CVE-2026-88394	WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export...	High	1 week ago
CVE-2026-63266	LibreOffice Calc can link a cell range to an external data source, and the link is saved in the...		1 week ago
CVE-2026-105286	A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function...	Medium	1 week ago
CVE-2026-104805	DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows...		1 week ago
CVE-2026-105293	Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that...	High	1 week ago
CVE-2026-105174	A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function...	Medium	1 week ago
CVE-2026-105157	A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element...	Medium	1 week ago
CVE-2026-105144	A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function...	Medium	1 week ago
CVE-2026-105125	LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated...	Low	1 week ago
CVE-2026-104983	A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function...	Medium	2 weeks ago
CVE-2026-76431	Path Traversal in Cisco Identity Services Engine (CVE-2026-76431)	Medium	2 weeks ago
CVE-2026-104982	A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function...	Medium	2 weeks ago
CVE-2026-87115	Path Traversal in WordPress (CVE-2026-87115)	Critical	2 weeks ago
CVE-2026-94238	Path Traversal in WordPress (CVE-2026-94238)	Medium	2 weeks ago
CVE-2026-85015	Path Traversal in WordPress (CVE-2026-85015)	Medium	2 weeks ago
CVE-2026-103293	Path Traversal in WordPress (CVE-2026-103293)	Medium	2 weeks ago
CVE-2026-104478	Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows...	High	2 weeks ago
CVE-2026-104871	Path Traversal in @angular/ssr (CVE-2026-104871)		2 weeks ago
CVE-2014-125130	Path Traversal in WordPress (CVE-2014-125130)	High	2 weeks ago
CVE-2026-104853	Path Traversal in nx (CVE-2026-104853)		2 weeks ago
CVE-2026-51906	In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path...	Critical	2 weeks ago
CVE-2026-51907	In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows…	High	2 weeks ago
CVE-2026-104843	Path Traversal in uv (CVE-2026-104843)		2 weeks ago
CVE-2026-103648	Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded…	Critical	2 weeks ago
CVE-2026-104721	Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal…		2 weeks ago

Title