CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
常见后果
影响范围: Integrity Confidentiality Availability
技术影响: Execute Unauthorized Code or Commands
说明: The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
影响范围: Integrity
技术影响: Modify Files or Directories
说明: The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
影响范围: Confidentiality
技术影响: Read Files or Directories
说明: The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
影响范围: Availability
技术影响: DoS: Crash, Exit, or Restart
说明: The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
潜在缓解措施
阶段: Implementation
策略: Input Validation
阶段: Architecture and Design
描述: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
阶段: Implementation
策略: Input Validation
阶段: Architecture and Design
策略: Libraries or Frameworks
描述: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
阶段: Operation
策略: Firewall
描述: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
有效性: Moderate
阶段: Architecture and Design Operation
策略: Environment Hardening
描述: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
阶段: Architecture and Design
策略: Enforcement by Conversion
阶段: Architecture and Design Operation
策略: Sandbox or Jail
有效性: Limited
阶段: Architecture and Design Operation
策略: Attack Surface Reduction
阶段: Implementation
阶段: Operation Implementation
策略: Environment Hardening
描述: When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
检测方法
方法: Automated Static Analysis
Automated techniques can find areas where path traversal weaknesses exist. However, tuning or customization may be required to remove or de-prioritize path-traversal problems that are only exploitable by the product's administrator - or other privileged users - and thus potentially valid behavior or, at worst, a bug instead of a vulnerability.
有效性: High
方法: Manual Static Analysis
Manual white box techniques may be able to provide sufficient code coverage and reduction of false positives if all file access operations can be assessed within limited time constraints.
有效性: High
方法: Automated Static Analysis - Binary or Bytecode
有效性: High
方法: Manual Static Analysis - Binary or Bytecode
有效性: SOAR Partial
方法: Dynamic Analysis with Automated Results Interpretation
有效性: High
方法: Dynamic Analysis with Manual Results Interpretation
有效性: High
方法: Manual Static Analysis - Source Code
有效性: High
方法: Automated Static Analysis - Source Code
有效性: High
方法: Architecture or Design Review
有效性: High
观察示例
参考: CVE-2024-37032
Large language model (LLM) management tool does not validate the format of a digest value (CWE-1287) from a private, untrusted model registry, enabling relative path traversal (CWE-23), a.k.a. Probllama
参考: CVE-2024-4315
Chain: API for text generation using Large Language Models (LLMs) does not include the "\" Windows folder separator in its denylist (CWE-184) when attempting to prevent Local File Inclusion via path traversal (CWE-22), allowing deletion of arbitrary files on Windows systems.
参考: CVE-2024-0520
Product for managing datasets for AI model training and evaluation allows both relative (CWE-23) and absolute (CWE-36) path traversal to overwrite files via the Content-Disposition header
参考: CVE-2022-45918
Chain: a learning management tool debugger uses external input to locate previous session logs (CWE-73) and does not properly validate the given path (CWE-20), allowing for filesystem path traversal using "../" sequences (CWE-24)
参考: CVE-2019-20916
Python package manager does not correctly restrict the filename specified in a Content-Disposition header, allowing arbitrary file read using path traversal sequences such as "../"
参考: CVE-2022-31503
Python package constructs filenames using an unsafe os.path.join call on untrusted input, allowing absolute path traversal because os.path.join resets the pathname to an absolute path that is specified as part of the input.
参考: CVE-2022-24877
directory traversal in Go-based Kubernetes operator app allows accessing data from the controller's pod file system via ../ sequences in a yaml file
参考: CVE-2021-21972
Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.
参考: CVE-2020-4053
a Kubernetes package manager written in Go allows malicious plugins to inject path traversal sequences into a plugin archive ("Zip slip") to copy a file outside the intended directory
参考: CVE-2020-3452
Chain: security product has improper input validation (CWE-20) leading to directory traversal (CWE-22), as exploited in the wild per CISA KEV.
参考: CVE-2019-10743
Go-based archive library allows extraction of files to locations outside of the target folder with "../" path traversal sequences in filenames in a zip file, aka "Zip Slip"
参考: CVE-2010-0467
Newsletter module allows reading arbitrary files using "../" sequences.
参考: CVE-2006-7079
Chain: PHP app uses extract for register_globals compatibility layer (CWE-621), enabling path traversal (CWE-22)
参考: CVE-2009-4194
FTP server allows deletion of arbitrary files using ".." in the DELE command.
参考: CVE-2009-4053
FTP server allows creation of arbitrary directories using ".." in the MKD command.
参考: CVE-2009-0244
FTP service for a Bluetooth device allows listing of directories, and creation or reading of files using ".." sequences.
参考: CVE-2009-4013
Software package maintenance program allows overwriting arbitrary files using "../" sequences.
参考: CVE-2009-4449
Bulletin board allows attackers to determine the existence of files using the avatar.
参考: CVE-2009-4581
PHP program allows arbitrary code execution using ".." in filenames that are fed to the include() function.
参考: CVE-2010-0012
Overwrite of files using a .. in a Torrent file.
参考: CVE-2010-0013
Chat program allows overwriting files using a custom smiley request.
参考: CVE-2008-5748
Chain: external control of values for user's desired language and theme enables path traversal.
参考: CVE-2009-1936
Chain: library file sends a redirect if it is directly requested but continues to execute, allowing remote file inclusion and path traversal.
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | - |
适用平台
编程语言
技术
分类映射
| 分类名称 | 条目ID | 条目名称 | 映射适配度 |
|---|---|---|---|
| PLOVER | - | Path Traversal | - |
| OWASP Top Ten 2007 | A4 | Insecure Direct Object Reference | CWE More Specific |
| OWASP Top Ten 2004 | A2 | Broken Access Control | CWE More Specific |
| CERT C Secure Coding | FIO02-C | Canonicalize path names originating from untrusted sources | - |
| SEI CERT Perl Coding Standard | IDS00-PL | Canonicalize path names before validating them | Exact |
| WASC | 33 | Path Traversal | - |
| Software Fault Patterns | SFP16 | Path Traversal | - |
| OMG ASCSM | ASCSM-CWE-22 | - |
关键信息
CWE ID: CWE-22
抽象级别: Base
结构: Simple
状态: Stable
利用可能性: High