CWE-23 相对路径遍历 类弱点 439 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-23 相对路径遍历漏洞源于软件未正确过滤外部输入中的“..”序列，导致构造的文件路径突破受限目录边界。攻击者通常利用此缺陷读取或修改系统敏感文件，获取未授权访问权限。开发者应避免直接使用用户输入拼接路径，需通过白名单验证、规范化路径或限制访问范围来彻底中和危险字符，从而防止路径逃逸。
http://example.com/get-files.jsp?file=report.pdf http://example.com/get-page.php?home=aaa.html http://example.com/some-page.asp?page=index.htmlhttp://example.com/get-files?file=../../../../somedir/somefile http://example.com/../../../../etc/shadow http://example.com/get-files?file=../../../../etc/passwdmy $dataPath = "/users/cwe/profiles"; my $username = param("user"); my $profilePath = $dataPath . "/" . $username; open(my $fh, "<", $profilePath) || ExitError("profile read error: $profilePath"); print "<ul>\n"; while (<$fh>) { print "<li>$_</li>\n"; } print "</ul>\n";../../../etc/passwd| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-11310 | TRCore DVC 安全漏洞 — DVC | 7.5 | High | 2024-11-18 |
| CVE-2024-11309 | TRCore DVC 安全漏洞 — DVC | 7.5 | High | 2024-11-18 |
| CVE-2024-35274 | Fortinet FortiManager和FortiAnalyzer 安全漏洞 — FortiAnalyzer | 2.2 | Low | 2024-11-12 |
| CVE-2024-32116 | Fortinet FortiManager和FortiAnalyzer 安全漏洞 — FortiAnalyzer | 4.8 | Medium | 2024-11-12 |
| CVE-2024-11067 | D-Link DSL6740C 安全漏洞 — DSL6740C | 7.5 | High | 2024-11-11 |
| CVE-2024-50453 | WordPress plugin The Pack Elementor addons 安全漏洞 — The Pack Elementor addons | 7.5 | High | 2024-10-28 |
| CVE-2024-10200 | Wellchoose Administrative Management System 安全漏洞 — Administrative Management System | 7.5 | High | 2024-10-21 |
| CVE-2024-47637 | WordPress plugin LiteSpeed Cache 安全漏洞 — LiteSpeed Cache | 8.8 | High | 2024-10-16 |
| CVE-2024-49253 | WordPress plugin Analyse Uploads 安全漏洞 — Analyse Uploads | 8.6 | High | 2024-10-16 |
| CVE-2024-9983 | Ragic Enterprise Cloud Database 安全漏洞 — Enterprise Cloud Database | 7.5 | High | 2024-10-15 |
| CVE-2024-45731 | Splunk Enterprise 安全漏洞 — Splunk Enterprise | 8.0 | High | 2024-10-14 |
| CVE-2024-9923 | TEAMPLUS Team+ 安全漏洞 — team+ | 4.9 | Medium | 2024-10-14 |
| CVE-2024-9922 | TEAMPLUS Team+ 安全漏洞 — team+ | 7.5 | High | 2024-10-14 |
| CVE-2024-6985 | LoLLMs 安全漏洞 — parisneo/lollms | 7.5AI | High AI | 2024-10-11 |
| CVE-2024-43614 | Microsoft Defender 安全漏洞 — Microsoft Defender for Endpoint for Linux | 5.5 | Medium | 2024-10-08 |
| CVE-2024-47948 | JetBrains TeamCity 安全漏洞 — TeamCity | 4.9 | Medium | 2024-10-08 |
| CVE-2024-47949 | JetBrains TeamCity 安全漏洞 — TeamCity | 4.9 | Medium | 2024-10-08 |
| CVE-2024-20449 | Cisco Nexus Dashboard Fabric Controller 安全漏洞 — Cisco Data Center Network Manager | 8.8 | High | 2024-10-02 |
| CVE-2024-9405 | Pluck 安全漏洞 — Pluck CMS | 5.3 | Medium | 2024-10-01 |
| CVE-2024-45816 | Backstage 安全漏洞 — backstage | 6.5 | Medium | 2024-09-17 |
| CVE-2024-43454 | Microsoft Windows 安全漏洞 — Windows Server 2008 Service Pack 2 | 7.1 | High | 2024-09-10 |
| CVE-2024-38258 | Microsoft Windows 安全漏洞 — Windows Server 2008 Service Pack 2 | 6.5 | Medium | 2024-09-10 |
| CVE-2024-43399 | Mobile Security Framework 安全漏洞 — Mobile-Security-Framework-MobSF | 8.0 | High | 2024-08-19 |
| CVE-2024-7693 | Team Johnlong software Raiden MAILD Mail Server 安全漏洞 — Raiden MAILD Remote Management System | 7.5 | High | 2024-08-12 |
| CVE-2024-6433 | Devika 安全漏洞 — stitionai/devika | 7.5AI | High AI | 2024-07-10 |
| CVE-2024-3122 | CHANGING Mobile One Time Password 安全漏洞 — Mobile One Time Password | 4.9 | Medium | 2024-07-01 |
| CVE-2024-5547 | Devika 安全漏洞 — stitionai/devika | 7.5AI | High AI | 2024-06-27 |
| CVE-2024-37138 | Dell PowerProtect Data Domain 安全漏洞 — PowerProtect DD | 4.1 | Medium | 2024-06-26 |
| CVE-2024-3497 | Toshiba e-STUDIO 安全漏洞 — Toshiba Tec e-Studio multi-function peripheral (MFP) | 8.8 | High | 2024-06-14 |
| CVE-2024-2461 | Hitachi XMC20 安全漏洞 — FOX61x | 7.5AI | High AI | 2024-06-11 |
CWE-23（相对路径遍历） 是常见的弱点类别，本平台收录该类弱点关联的 439 条 CVE 漏洞。