CWE-23 相对路径遍历 类弱点 439 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-23 相对路径遍历漏洞源于软件未正确过滤外部输入中的“..”序列，导致构造的文件路径突破受限目录边界。攻击者通常利用此缺陷读取或修改系统敏感文件，获取未授权访问权限。开发者应避免直接使用用户输入拼接路径，需通过白名单验证、规范化路径或限制访问范围来彻底中和危险字符，从而防止路径逃逸。
http://example.com/get-files.jsp?file=report.pdf http://example.com/get-page.php?home=aaa.html http://example.com/some-page.asp?page=index.htmlhttp://example.com/get-files?file=../../../../somedir/somefile http://example.com/../../../../etc/shadow http://example.com/get-files?file=../../../../etc/passwdmy $dataPath = "/users/cwe/profiles"; my $username = param("user"); my $profilePath = $dataPath . "/" . $username; open(my $fh, "<", $profilePath) || ExitError("profile read error: $profilePath"); print "<ul>\n"; while (<$fh>) { print "<li>$_</li>\n"; } print "</ul>\n";../../../etc/passwd| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-2139 | Advantech iView 路径遍历漏洞 — iView | 6.5 | Medium | 2022-07-22 |
| CVE-2022-20913 | Cisco Nexus Dashboard 输入验证错误漏洞 — Cisco Nexus Dashboard | 4.9 | Medium | 2022-07-21 |
| CVE-2022-20862 | Cisco Unified Communications Manager 路径遍历漏洞 — Cisco Unified Communications Manager | 4.3 | Medium | 2022-07-06 |
| CVE-2022-2106 | Elcomplus LLC SmartICS 路径遍历漏洞 — SmartICS | 3.8 | Low | 2022-06-27 |
| CVE-2022-29097 | Dell WMS 路径遍历漏洞 — Wyse Management Suite | 4.9 | Medium | 2022-06-24 |
| CVE-2022-2120 | OFFIS DCMTK 路径遍历漏洞 — DCMTK | 7.5 | High | 2022-06-24 |
| CVE-2022-1661 | 多款Keysight Technologies产品路径遍历漏洞 — N6854A Geolocation server and N6841A RF Sensor software | 7.5 | High | 2022-05-31 |
| CVE-2021-32964 | AGG Software Web Server 路径遍历漏洞 — Web Server (webserver.dll) | 6.5 | Medium | 2022-05-24 |
| CVE-2021-34605 | XINJE XD/E Series PLC Program Tool 安全漏洞 — XD/E Series PLC Program Tool | 7.3 | High | 2022-05-11 |
| CVE-2022-20790 | Cisco Unified Communications Manager 路径遍历漏洞 — Cisco Unified Communications Manager | 6.5 | Medium | 2022-04-21 |
| CVE-2020-25150 | B. Braun Melsungen Ag B. Braun Melsungen AG SpaceCom 路径遍历漏洞 — SpaceCom | 7.6 | High | 2022-04-14 |
| CVE-2022-22279 | Sonicwall SonicWall SSLVPN 路径遍历漏洞 — SonicWall SRA/SMA100 | 4.9 | - | 2022-04-13 |
| CVE-2022-20755 | Cisco Expressway Series 安全漏洞 — Cisco TelePresence Video Communication Server (VCS) Expressway | 9.0 | Critical | 2022-04-06 |
| CVE-2022-20754 | Cisco Expressway Series 安全漏洞 — Cisco TelePresence Video Communication Server (VCS) Expressway | 9.0 | Critical | 2022-04-06 |
| CVE-2022-23732 | GitHub Enterprise Server 路径遍历漏洞 — GitHub Enterprise Server | 8.8 | - | 2022-04-05 |
| CVE-2021-32949 | MDT AutoSave 路径遍历漏洞 — MDT AutoSave | 7.5 | High | 2022-04-01 |
| CVE-2020-25176 | Rockwell Automation ISaGRAF 路径遍历漏洞 — ISaGRAF Runtime | 9.1 | Critical | 2022-03-18 |
| CVE-2022-21808 | Yokogawa Exaopc 路径遍历漏洞 — CENTUM CS 3000 | 8.8 | - | 2022-03-11 |
| CVE-2022-21177 | Yokogawa Exaopc 路径遍历漏洞 — CENTUM CS 3000 | 8.1 | - | 2022-03-11 |
| CVE-2021-37196 | Siemens Comos 路径遍历漏洞 — COMOS V10.2 | 5.5 | - | 2022-01-11 |
| CVE-2021-41242 | OpenOLAT 路径遍历漏洞 — OpenOLAT | 8.1 | High | 2021-12-10 |
| CVE-2021-20040 | Sonicwall SMA100 路径遍历漏洞 — SonicWall SMA100 | 5.3 | - | 2021-12-08 |
| CVE-2021-43176 | GOautodial 路径遍历漏洞 — GOautodial API | 8.8 | - | 2021-12-07 |
| CVE-2021-43555 | mySCADA myDESIGNER 路径遍历漏洞 — myDESIGNER | 7.3 | High | 2021-11-19 |
| CVE-2021-22870 | GitHub Enterprise Server 路径遍历漏洞 — GitHub Enterprise Server | 6.5 | - | 2021-11-10 |
| CVE-2021-34594 | Beckhoff Automation TwinCat Opc Ua Server 路径遍历漏洞 — TwinCAT OPC UA Server | 6.5 | Medium | 2021-11-04 |
| CVE-2021-41178 | Nextcloud 路径遍历漏洞 — security-advisories | 8.8 | High | 2021-10-25 |
| CVE-2020-27304 | CivetWeb 路径遍历漏洞 — civetweb | 9.1 | - | 2021-10-21 |
| CVE-2021-32825 | bblfshd 后置链接漏洞 — bblfshd | 2.7 | Low | 2021-08-16 |
| CVE-2021-22674 | Advantech WebAccess/SCADA 路径遍历漏洞 — WebAccess/SCADA | 6.5 | - | 2021-08-10 |
CWE-23（相对路径遍历） 是常见的弱点类别，本平台收录该类弱点关联的 439 条 CVE 漏洞。