Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 96
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 20125 Cwe 78120 Cwe 787105 Cwe 41699 Cwe 11990 Cwe 9484 Cwe 50270 Cwe 7966 Cwe 8954 Cwe 91844 Cwe 28443 Cwe 28741 Cwe 7740 Cwe 30638 Cwe 84337

🛡 Vulnerabilities tagged with this 1,817

ID Title
CVE-2026-68062 SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this...
CVE-2026-78638 Path Traversal in path-traversal (CVE-2026-78638)
CVE-2026-78677 GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing...
CVE-2026-72695 Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that...
CVE-2026-72697 Path Traversal in path-traversal (CVE-2026-72697)
CVE-2026-34968 Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the...
CVE-2026-78284 Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
CVE-2026-78435 Path Traversal in path-traversal (CVE-2026-78435)
CVE-2026-71932 Path Traversal in path-traversal (CVE-2026-71932)
CVE-2026-77914 Path Traversal in path-traversal (CVE-2026-77914)
CVE-2026-71364 Path Traversal in path-traversal (CVE-2026-71364)
CVE-2026-78381 Path Traversal in path-traversal (CVE-2026-78381)
CVE-2026-76842 Path Traversal in CVE-2026-76842 (CVE-2026-76842)
CVE-2026-76844 Path Traversal in CVE-2026-76844 (CVE-2026-76844)
CVE-2026-28171 Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
CVE-2026-32477 Path Traversal in CVE-2026-32477 (CVE-2026-32477)
CVE-2026-28167 Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.
CVE-2026-66897 Path Traversal in path-traversal (CVE-2026-66897)
CVE-2026-78196 Path Traversal in path-traversal (CVE-2026-78196)
CVE-2026-10053 Path Traversal in path-traversal (CVE-2026-10053)
CVE-2026-18027 Path Traversal in wordpress (CVE-2026-18027)
CVE-2026-76606 Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.3 - ???.
CVE-2026-76598 Path Traversal in CVE-2026-76598 (CVE-2026-76598)
CVE-2026-63312 Path Traversal in CVE-2026-63312 (CVE-2026-63312)
CVE-2026-62383 Path Traversal in c (CVE-2026-62383)
CVE-2026-62384 Path Traversal in CVE-2026-62384 (CVE-2026-62384)
CVE-2026-71514 Path Traversal in path-traversal (CVE-2026-71514)
CVE-2026-60084 Path Traversal in CVE-2026-60084 (CVE-2026-60084)
CVE-2026-48105 Path Traversal in CVE-2026-48105 (CVE-2026-48105)
CVE-2026-64679 Path Traversal in github.com/runatlantis/atlantis (CVE-2026-64679)

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →