What MITRE CWE-22 - Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) requires
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal or Directory Traversal) is a CWE Top 25 weakness with consistent presence in file-handling vulnerabilities across web applications, file servers, container runtimes, and archive extractors. CWE-22 is defined as: the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. The Extended Description explains: file operations frequently occur within confined directories; attackers can exploit special elements like .. and / separators to break outside restricted locations; the ../ sequence represents the parent directory in modern operating systems, enabling relative path traversal; absolute pathnames (e.g., /usr/local/bin) create absolute path traversal variants. Common Consequences include execute unauthorized code or commands (attackers may create or overwrite critical files used for code execution, such as programs or libraries); modify files or directories (critical files like programs, libraries, or data can be overwritten or created; security mechanisms may be bypassed); read files or directories (unexpected files may be read, exposing sensitive data and potentially circumventing security mechanisms); and DoS via crash, exit, or restart (attackers may overwrite, delete, or corrupt critical files preventing normal operation). Potential Mitigations include input validation using allowlists of acceptable inputs strictly conforming to specifications (for filenames, restrict character sets and exclude directory separators); path canonicalization using built-in functions (realpath in C/PHP, getCanonicalPath in Java) to produce canonical pathnames that remove .. sequences; privilege minimization (execute code with minimal necessary privileges using isolated accounts); sandbox or jail environments (restrict file access through OS-level mechanisms like chroot jails or AppArmor); and attack surface reduction (store library files outside web document roots and prevent direct requests).
Pillar: Cybersecurity · Authority: MITRE Corporation / Common Weakness Enumeration · Version: 1.0.0 · Last updated:
Primary source: https://cwe.mitre.org/data/definitions/22.html
SHA-256 integrity: 940aef28e1650e38c4168bcb7ff5ee91ed1d2352ae57dc213b8ddd147bf0c6e0
Primary Citations — 9 traced to source
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) - MITRE Common Weakness Enumeration at https://cwe.mitre.org/data/definitions/22.html
- CWE-22 Definition - the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory
+ 7 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-cwe-22-path-traversal.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-cwe-22-path-traversal.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-cwe-22-path-traversal
- Back to registry: Browse all 10,085 compliance nodes