# CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

**Likelihood of exploit:** High · **KEV-linked**

> As of 2026-10-05, CWE-22 (Path Traversal) underlies 124 CVEs tracked by Threadlinqs, 21 of them in the CISA Known Exploited Vulnerabilities catalog, and is cited by 114 tracked threats. MITRE rates its likelihood of exploit as High.

**Last updated:** 2026-10-05

## What is CWE-22?

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.

CWE-22 is a base-level weakness in MITRE’s Common Weakness Enumeration, with a MITRE likelihood of exploit of High. Applicable platforms: Language: Not Language-Specific; Technology: AI/ML.

_Source: [MITRE CWE](https://cwe.mitre.org/data/definitions/22.html) (CWE-22 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data._

## Consequences

- **Integrity, Confidentiality, Availability** — Execute Unauthorized Code or Commands. The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
- **Integrity** — Modify Files or Directories. The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
- **Confidentiality** — Read Files or Directories. The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
- **Availability** — DoS: Crash, Exit, or Restart. The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.

_Source: MITRE CWE, common consequences._

## How CWE-22 is exploited in the wild

Threadlinqs maps 124 CVEs to CWE-22, published between 2019-05-08 and 2026-10-01. 21 are listed in CISA’s Known Exploited Vulnerabilities catalog, the authoritative record of exploitation in the wild, and 10 are tied to ransomware campaigns. By CVSS v3 severity the set splits into 29 critical, 51 high, 33 medium, 3 low. The highest EPSS score in the set is 99.9% (CVE-2023-32315), the modelled probability of exploitation in the next 30 days. 114 tracked threats reference CWE-22 directly or through a CVE it covers; the most recent is “Multiple High-Severity Vulnerabilities in TeamViewer Client (CVE-2026-92370, CVE-2026-92368, CVE-2026-92369, CVE-2026-92371, CVE-2026-19743)” (2026-10-02). Affected products concentrate in Solarwinds (8), Microsoft (6), IBM (4), among 83 vendors in total.

## Vulnerabilities (CVEs)

Showing 40 of 124 CVEs mapped to CWE-22, CISA KEV first, then by CVSS score.

- [CVE-2026-48282](https://intel.threadlinqs.com/cve/CVE-2026-48282) — CISA KEV · CVSS 10 critical · EPSS 28.5% · published 2026-06-30
- [CVE-2026-85706](https://intel.threadlinqs.com/cve/CVE-2026-85706) — CISA KEV · CVSS 10 critical · EPSS 1.1% · published 2026-09-12
- [CVE-2019-11510](https://intel.threadlinqs.com/cve/CVE-2019-11510) — CISA KEV · CVSS 9.9 critical · EPSS 99.9% · published 2019-05-08
- [CVE-2020-5902](https://intel.threadlinqs.com/cve/CVE-2020-5902) — CISA KEV · CVSS 9.8 critical · EPSS 99.9% · published 2020-07-01
- [CVE-2024-23897](https://intel.threadlinqs.com/cve/CVE-2024-23897) — CISA KEV · CVSS 9.8 critical · EPSS 94.4% · published 2024-01-24
- [CVE-2019-19781](https://intel.threadlinqs.com/cve/CVE-2019-19781) — CISA KEV · CVSS 9.8 critical · EPSS 94.4% · published 2019-12-27
- [CVE-2022-37042](https://intel.threadlinqs.com/cve/CVE-2022-37042) — CISA KEV · CVSS 9.8 critical · EPSS 91.8% · published 2022-08-11
- [CVE-2026-93616](https://intel.threadlinqs.com/cve/CVE-2026-93616) — CISA KEV · CVSS 9.8 critical · EPSS 2.4% · published 2026-09-22
- [CVE-2026-104286](https://intel.threadlinqs.com/cve/CVE-2026-104286) — CISA KEV · CVSS 9.8 critical · published 2026-10-01
- [CVE-2024-8963](https://intel.threadlinqs.com/cve/CVE-2024-8963) — CISA KEV · CVSS 9.4 critical · EPSS 94.2% · published 2024-09-19
- [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379) — CISA KEV · CVSS 9.1 critical · EPSS 94.4% · published 2019-06-04
- [CVE-2021-40444](https://intel.threadlinqs.com/cve/CVE-2021-40444) — CISA KEV · CVSS 8.8 high · EPSS 94.3% · published 2021-09-15
- [CVE-2023-32315](https://intel.threadlinqs.com/cve/CVE-2023-32315) — CISA KEV · CVSS 8.6 high · EPSS 99.9% · published 2023-05-26
- [CVE-2021-27065](https://intel.threadlinqs.com/cve/CVE-2021-27065) — CISA KEV · CVSS 7.8 high · EPSS 94.2% · published 2021-03-03
- [CVE-2025-6218](https://intel.threadlinqs.com/cve/CVE-2025-6218) — CISA KEV · CVSS 7.8 high · EPSS 4.7% · published 2025-06-21
- [CVE-2022-20775](https://intel.threadlinqs.com/cve/CVE-2022-20775) — CISA KEV · CVSS 7.8 high · EPSS 0.4% · published 2022-09-30
- [CVE-2025-61884](https://intel.threadlinqs.com/cve/CVE-2025-61884) — CISA KEV · CVSS 7.5 high · EPSS 97.5% · published 2025-10-12
- [CVE-2024-57727](https://intel.threadlinqs.com/cve/CVE-2024-57727) — CISA KEV · CVSS 7.5 high · EPSS 94.0% · published 2025-01-15
- [CVE-2022-27925](https://intel.threadlinqs.com/cve/CVE-2022-27925) — CISA KEV · CVSS 7.2 high · EPSS 98.1% · published 2022-04-20
- [CVE-2023-35081](https://intel.threadlinqs.com/cve/CVE-2023-35081) — CISA KEV · CVSS 7.2 high · EPSS 91.1% · published 2023-08-03
- [CVE-2022-41328](https://intel.threadlinqs.com/cve/CVE-2022-41328) — CISA KEV · CVSS 6.7 medium · EPSS 0.1% · published 2023-03-07
- [CVE-2026-70200](https://intel.threadlinqs.com/cve/CVE-2026-70200) — CVSS 10 critical · EPSS 0.5% · published 2026-09-17
- [CVE-2026-25592](https://intel.threadlinqs.com/cve/CVE-2026-25592) — CVSS 10 critical · EPSS 0.0% · published 2026-02-06
- [CVE-2026-34909](https://intel.threadlinqs.com/cve/CVE-2026-34909) — CVSS 10 critical · EPSS 0.0% · published 2026-05-22
- [CVE-2026-48318](https://intel.threadlinqs.com/cve/CVE-2026-48318) — CVSS 9.9 critical · EPSS 6.6% · published 2026-07-14
- [CVE-2026-82954](https://intel.threadlinqs.com/cve/CVE-2026-82954) — CVSS 9.9 critical · EPSS 0.6% · published 2026-08-31
- [CVE-2026-18169](https://intel.threadlinqs.com/cve/CVE-2026-18169) — CVSS 9.9 critical · EPSS 0.5% · published 2026-09-22
- [CVE-2026-61445](https://intel.threadlinqs.com/cve/CVE-2026-61445) — CVSS 9.9 critical · published 2026-07-11
- [CVE-2020-5639](https://intel.threadlinqs.com/cve/CVE-2020-5639) — CVSS 9.8 critical · EPSS 9.2% · published 2020-12-14
- [CVE-2024-23472](https://intel.threadlinqs.com/cve/CVE-2024-23472) — CVSS 9.6 critical · EPSS 7.4% · published 2024-07-17
- [CVE-2024-23467](https://intel.threadlinqs.com/cve/CVE-2024-23467) — CVSS 9.6 critical · EPSS 3.3% · published 2024-07-17
- [CVE-2024-23466](https://intel.threadlinqs.com/cve/CVE-2024-23466) — CVSS 9.6 critical · EPSS 3.1% · published 2024-07-17
- [CVE-2026-82100](https://intel.threadlinqs.com/cve/CVE-2026-82100) — CVSS 9.6 critical · EPSS 0.4% · published 2026-09-10
- [CVE-2024-23475](https://intel.threadlinqs.com/cve/CVE-2024-23475) — CVSS 9.6 critical · EPSS 0.2% · published 2024-07-17
- [CVE-2026-70009](https://intel.threadlinqs.com/cve/CVE-2026-70009) — CVSS 9.3 critical · EPSS 0.4% · published 2026-09-17
- [CVE-2026-42608](https://intel.threadlinqs.com/cve/CVE-2026-42608) — CVSS 9.1 critical · EPSS 0.5% · published 2026-05-11
- [CVE-2026-86542](https://intel.threadlinqs.com/cve/CVE-2026-86542) — CVSS 9.1 critical · EPSS 0.4% · published 2026-09-07
- [CVE-2026-42162](https://intel.threadlinqs.com/cve/CVE-2026-42162) — CVSS 9.1 critical · EPSS 0.1% · published 2026-08-17
- [CVE-2026-53581](https://intel.threadlinqs.com/cve/CVE-2026-53581) — CVSS 9 critical · EPSS 0.3% · published 2026-09-08
- [CVE-2024-37032](https://intel.threadlinqs.com/cve/CVE-2024-37032) — CVSS 8.8 high · EPSS 93.6% · published 2024-05-31

## Affected vendors

- [Solarwinds](https://intel.threadlinqs.com/vendors/solarwinds) — 8 CVEs
- [Microsoft](https://intel.threadlinqs.com/vendors/microsoft) — 6 CVEs
- [IBM](https://intel.threadlinqs.com/vendors/ibm) — 4 CVEs
- [knowns-dev](https://intel.threadlinqs.com/vendors/knowns-dev) — 4 CVEs
- [Cisco](https://intel.threadlinqs.com/vendors/cisco) — 3 CVEs
- [Fortinet](https://intel.threadlinqs.com/vendors/fortinet) — 3 CVEs
- [Ivanti](https://intel.threadlinqs.com/vendors/ivanti) — 3 CVEs
- **triggerdotdev** — 3 CVEs
- [Adobe](https://intel.threadlinqs.com/vendors/adobe) — 2 CVEs
- **Linuxfabrik** — 2 CVEs
- [MervinPraison](https://intel.threadlinqs.com/vendors/mervinpraison) — 2 CVEs
- [Ollama](https://intel.threadlinqs.com/vendors/ollama) — 2 CVEs

## Threat activity

114 tracked threats cite CWE-22; the 25 most recent are listed.

- [Multiple High-Severity Vulnerabilities in TeamViewer Client (CVE-2026-92370, CVE-2026-92368, CVE-2026-92369, CVE-2026-92371, CVE-2026-19743)](https://intel.threadlinqs.com/threat/TL-2026-2905) — HIGH · 2026-10-02
- [Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attacks](https://intel.threadlinqs.com/threat/TL-2026-2830) — CRITICAL · 2026-10-01
- [Docker CopyEscape (CVE-2026-17106): docker cp / sbx cp flaw lets malicious containers overwrite host files](https://intel.threadlinqs.com/threat/TL-2026-2812) — HIGH · 2026-09-30
- [GTIG: AI-Era Vulnerability Discovery and Exploitation Surge — In-the-Wild Exploitation of BeyondTrust CVE-2026-1731, LiteLLM CVE-2026-42271 and Langflow CVE-2026-5027](https://intel.threadlinqs.com/threat/TL-2026-2818) — CRITICAL · 2026-09-30
- [CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth Bypass (CVE-2026-67279)](https://intel.threadlinqs.com/threat/TL-2026-2669) — CRITICAL · 2026-09-26
- [ShinyHunters Exploit Grav CMS Path Traversal (CVE-2026-42608) to Hack Clop Ransomware Gang's Leak Site](https://intel.threadlinqs.com/threat/TL-2026-2671) — CRITICAL · 2026-09-26
- [Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day (CVE-2026-93616) Actively Exploited](https://intel.threadlinqs.com/threat/TL-2026-2677) — CRITICAL · 2026-09-26
- [CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud Orchestrator Auth Bypass, F5 BIG-IP APM Heap Overflow](https://intel.threadlinqs.com/threat/TL-2026-2678) — CRITICAL · 2026-09-26
- [Check Point Patches Actively Exploited Zero-Day Path Traversal in Management Server (CVE-2026-93616)](https://intel.threadlinqs.com/threat/TL-2026-2617) — CRITICAL · 2026-09-22
- [Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti UniFi OS Flaws to Steal Government Data](https://intel.threadlinqs.com/threat/TL-2026-2619) — CRITICAL · 2026-09-22
- [CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE)](https://intel.threadlinqs.com/threat/TL-2026-2623) — CRITICAL · 2026-09-22
- [eBPF Rootkit Detection: VoidLink, LinkPro, and Atomic Arch Evade Kernel-Level Monitoring](https://intel.threadlinqs.com/threat/TL-2026-2624) — MEDIUM · 2026-09-22
- [Microsoft September 2026 Cloud Disclosure: 18 Elevation-of-Privilege, Information-Disclosure, and Spoofing Flaws Across Azure and Copilot AI Products, Plus a Windows Secure Kernel EoP (CVE-2026-85921)](https://intel.threadlinqs.com/threat/TL-2026-2563) — CRITICAL · 2026-09-18
- [Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices](https://intel.threadlinqs.com/threat/TL-2026-2517) — HIGH · 2026-09-15
- [Apple Ships 273-CVE Coordinated Security Update Across iOS 27, macOS, watchOS, tvOS, visionOS, Safari, and Xcode — Bundles a Previously KEV-Listed Pre-Auth Screen Sharing RCE](https://intel.threadlinqs.com/threat/TL-2026-2522) — CRITICAL · 2026-09-15
- [Multiple Vulnerabilities in Nozomi Guardian/CMC Before 25.4.0 on Siemens RUGGEDCOM APE1808 Devices (CVE-2024-13089, CVE-2024-13090, CVE-2025-3719, CVE-2025-40889, et al.)](https://intel.threadlinqs.com/threat/TL-2026-2487) — HIGH · 2026-09-13
- [GitLab Patches Max-Severity Unauthenticated Path Traversal Flaw in Repository Commits API (CVE-2026-85706, CVSS 10.0)](https://intel.threadlinqs.com/threat/TL-2026-2442) — CRITICAL · 2026-09-11
- [Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)](https://intel.threadlinqs.com/threat/TL-2026-2345) — CRITICAL · 2026-09-06
- [Chinese-Speaking Operator "Nie" Uses SecFlow AI Orchestration Framework (Claude, Qwen, DeepSeek) and GLUTTON Steganographic Webshell in Multi-Country Espionage Campaign](https://intel.threadlinqs.com/threat/TL-2026-2325) — HIGH · 2026-09-04
- [UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in Unitree G1 EDU Humanoid Robot (CVE-2026-76639, CVE-2026-76640)](https://intel.threadlinqs.com/threat/TL-2026-2196) — CRITICAL · 2026-08-28
- [Adobe and Nvidia Patch Dozens of Vulnerabilities Across Multiple Products, Including Two Critical Flaws in Nvidia's NemoClaw AI Agent Stack and a CVSS 10.0 Adobe Campaign Classic Chain](https://intel.threadlinqs.com/threat/TL-2026-2152) — CRITICAL · 2026-08-26
- [Edge Infrastructure Under Siege: Tenable and SentinelOne Datasets Reveal Convergent Nation-State and Criminal Exploitation of Perimeter Devices](https://intel.threadlinqs.com/threat/TL-2026-2153) — HIGH · 2026-08-26
- [LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)](https://intel.threadlinqs.com/threat/TL-2026-2094) — HIGH · 2026-08-21
- [Chinese-speaking threat group UAT-10147 uses agentic AI to automate exploitation of internet-facing web servers](https://intel.threadlinqs.com/threat/TL-2026-2096) — HIGH · 2026-08-21
- [91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285](https://intel.threadlinqs.com/threat/TL-2026-2105) — CRITICAL · 2026-08-21

## Mitigations

- **Implementation / Input Validation**: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected…
- **Architecture and Design**: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- **Implementation / Input Validation**: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked. Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes: realpath() in C getCanonicalPath() in Java GetFullPath() in ASP.NET realpath() or abs_path() in Perl realpath() in PHP
- **Architecture and Design / Libraries or Frameworks**: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- **Operation / Firewall**: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
- **Architecture and Design, Operation / Environment Hardening**: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
- **Architecture and Design / Enforcement by Conversion**: When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability.
- **Architecture and Design, Operation / Sandbox or Jail**: Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid…
- **Architecture and Design, Operation / Attack Surface Reduction**: Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately. This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce the attack surface.
- **Implementation**: Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to…

_Source: MITRE CWE, potential mitigations._

## Detection methods (MITRE CWE)

- **Automated Static Analysis** (effectiveness: High): Automated techniques can find areas where path traversal weaknesses exist. However, tuning or customization may be required to remove or de-prioritize path-traversal problems that are only exploitable by the product's administrator - or other privileged users - and thus potentially valid behavior or, at worst, a bug instead of a vulnerability.
- **Manual Static Analysis** (effectiveness: High): Manual white box techniques may be able to provide sufficient code coverage and reduction of false positives if all file access operations can be assessed within limited time constraints.
- **Automated Static Analysis - Binary or Bytecode** (effectiveness: High): According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Cost effective for partial coverage: Binary Weakness Analysis - including disassembler + source code weakness analysis
- **Manual Static Analysis - Binary or Bytecode** (effectiveness: SOAR Partial): According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
- **Dynamic Analysis with Automated Results Interpretation** (effectiveness: High): According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Web Application Scanner Web Services Scanner Database Scanners
- **Dynamic Analysis with Manual Results Interpretation** (effectiveness: High): According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Fuzz Tester Framework-based Fuzzer
- **Manual Static Analysis - Source Code** (effectiveness: High): According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused Manual Spotcheck - Focused manual analysis of source
- **Automated Static Analysis - Source Code** (effectiveness: High): According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer

_Source: MITRE CWE, detection methods. Threadlinqs detection rules for the threats above are Blue tier and higher._

## Related weaknesses

- [CWE-706](https://cwe.mitre.org/data/definitions/706.html)
- [CWE-668 Exposure of Resource to Wrong Sphere](https://intel.threadlinqs.com/cwe/CWE-668)

Canonical: https://intel.threadlinqs.com/cwe/CWE-22
Source definition: https://cwe.mitre.org/data/definitions/22.html
Detection rules and IOCs for threats exploiting CWE-22 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp