CWE-23 相对路径遍历 类弱点 439 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-23 相对路径遍历漏洞源于软件未正确过滤外部输入中的“..”序列，导致构造的文件路径突破受限目录边界。攻击者通常利用此缺陷读取或修改系统敏感文件，获取未授权访问权限。开发者应避免直接使用用户输入拼接路径，需通过白名单验证、规范化路径或限制访问范围来彻底中和危险字符，从而防止路径逃逸。
http://example.com/get-files.jsp?file=report.pdf http://example.com/get-page.php?home=aaa.html http://example.com/some-page.asp?page=index.htmlhttp://example.com/get-files?file=../../../../somedir/somefile http://example.com/../../../../etc/shadow http://example.com/get-files?file=../../../../etc/passwdmy $dataPath = "/users/cwe/profiles"; my $username = param("user"); my $profilePath = $dataPath . "/" . $username; open(my $fh, "<", $profilePath) || ExitError("profile read error: $profilePath"); print "<ul>\n"; while (<$fh>) { print "<li>$_</li>\n"; } print "</ul>\n";../../../etc/passwd| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-4330 | LoLLMs 路径遍历漏洞 — parisneo/lollms-webui | 7.5AI | High AI | 2024-05-30 |
| CVE-2024-36362 | JetBrains TeamCity 安全漏洞 — TeamCity | 6.5 | Medium | 2024-05-29 |
| CVE-2024-35186 | gitoxide 安全漏洞 — gitoxide | 8.8 | High | 2024-05-23 |
| CVE-2023-3941 | ZkTeco OEM 路径遍历漏洞 — ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 | 10.0 | Critical | 2024-05-21 |
| CVE-2023-3940 | ZkTeco OEM 路径遍历漏洞 — ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 | 7.5 | High | 2024-05-21 |
| CVE-2024-33615 | Cyber Power Systems PowerPanel Business Edition 安全漏洞 — PowerPanel business | 8.8 | High | 2024-05-15 |
| CVE-2024-30010 | Microsoft Windows Hyper-V 安全漏洞 — Windows Server 2019 | 8.8 | High | 2024-05-14 |
| CVE-2024-34712 | Oceanic 安全漏洞 — Oceanic | 6.5 | Medium | 2024-05-14 |
| CVE-2024-0549 | AnythingLLM 路径遍历漏洞 — mintplex-labs/anything-llm | 8.1 | - | 2024-04-16 |
| CVE-2024-32005 | NiceGUI 安全漏洞 — nicegui | 8.2 | High | 2024-04-12 |
| CVE-2024-3025 | AnythingLLM 安全漏洞 — mintplex-labs/anything-llm | 9.1AI | Critical AI | 2024-04-10 |
| CVE-2024-0335 | 部分ABB产品 输入验证错误漏洞 — Symphony Plus S+ Operations | 7.5 | High | 2024-04-03 |
| CVE-2024-20352 | Cisco Emergency Responder 安全漏洞 — Cisco Emergency Responder | 4.9 | Medium | 2024-04-03 |
| CVE-2024-20310 | Cisco Unified Communications Manager 安全漏洞 — Cisco IOS XE Software | 6.1 | Medium | 2024-04-03 |
| CVE-2024-25944 | Dell OpenManage Enterprise 安全漏洞 — Dell OpenManage Enterprise | 5.7 | Medium | 2024-03-29 |
| CVE-2024-24578 | RaspberryMatic 安全漏洞 — RaspberryMatic | 10.0 | Critical | 2024-03-18 |
| CVE-2024-27770 | Unitronics Unistream Unilogic 安全漏洞 — Unistream Unilogic | 8.8 | High | 2024-03-18 |
| CVE-2023-6825 | WordPress Plugin File Manager And File Manager Pro 安全漏洞 — File Manager | 9.9 | Critical | 2024-03-13 |
| CVE-2024-2053 | Artica Proxy 安全漏洞 — Artica Proxy | 9.8AI | Critical AI | 2024-03-05 |
| CVE-2024-27199 | JetBrains TeamCity 安全漏洞 — TeamCity | 7.3 | High | 2024-03-04 |
| CVE-2024-0550 | AnythingLLM 安全漏洞 — mintplex-labs/anything-llm | 4.9 | - | 2024-02-28 |
| CVE-2023-42791 | Fortinet FortiManager和FortiAnalyzer 安全漏洞 — FortiManager | 8.6 | High | 2024-02-20 |
| CVE-2024-22226 | Dell Unity 路径遍历漏洞 — Unity | 3.3 | Low | 2024-02-12 |
| CVE-2024-24942 | JetBrains TeamCity 安全漏洞 — TeamCity | 5.3 | Medium | 2024-02-06 |
| CVE-2024-24940 | JetBrains IntelliJ IDEA 安全漏洞 — IntelliJ IDEA | 2.8 | Low | 2024-02-06 |
| CVE-2024-24938 | JetBrains TeamCity 安全漏洞 — TeamCity | 5.3 | Medium | 2024-02-06 |
| CVE-2021-22281 | B&R Industrial Automation Studio 路径遍历漏洞 — Automation Studio | 6.3 | Medium | 2024-02-02 |
| CVE-2024-22096 | Rapid Software Rapid SCADA 安全漏洞 — Rapid SCADA | 6.5 | Medium | 2024-02-01 |
| CVE-2024-22415 | jupyterlab-lsp 安全漏洞 — jupyterlab-lsp | 7.3 | High | 2024-01-18 |
| CVE-2023-31036 | NVIDIA Triton Inference Server 安全漏洞 — Triton Inference Server | 7.5 | High | 2024-01-12 |
CWE-23（相对路径遍历） 是常见的弱点类别，本平台收录该类弱点关联的 439 条 CVE 漏洞。