目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-35 路径遍历：’…/…//’ 类漏洞列表 181

CWE-35 路径遍历：’…/…//’ 类弱点 181 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-35 属于路径遍历漏洞，指程序使用外部输入构建受限目录内的文件路径时，未正确过滤“.../...//”等双重重定向序列。攻击者利用此缺陷，通过构造特殊路径字符序列绕过安全检查，访问或修改目录外的敏感文件。开发者应避免直接拼接用户输入，需对路径进行严格规范化处理，并实施白名单验证，确保最终解析路径始终位于预期的安全目录范围内。

MITRE CWE 官方描述
CWE：CWE-35 路径遍历：'.../...//' 英文：产品使用外部输入来构建一个应位于受限目录内的路径名，但它未能正确对 '.../...//'（双重重叠点斜杠）序列进行中和，这些序列可能解析到该目录之外的位置。
常见影响 (1)
Confidentiality, Integrity Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism
Not properly neutralizing '.../...//' (doubled triple dot slash) allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
缓解措施 (2)
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Effectiveness: High
Implementation Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
代码示例 (1)
Suppose the product serves files from a specific "public" directory -- /home/product/public/ -- and has an algorithm that attempts to protect against common path traversal attacks. The algorithm works by sequentially scanning through a requested filename and removes each occurrence of "../" that it encounters, then appending the filename to the public directory.
../secret.dat
Attack
/home/product/public/secret.dat
Result
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-39734 WordPress WP EasyPay 4.5.4 路径遍历漏洞 — WP EasyPay 7.5 High 2026-10-30
CVE-2026-118633 Sophos UTM 路径遍历漏洞允许远程未认证攻击者以 root 权限执行任意代码 — SG UTM 8.1 High 2026-10-28
CVE-2026-44415 GitLab越权访问漏洞 — Industrial Edge Device Kit - arm64 V1.10 9.1 Critical 2026-10-13
CVE-2026-44414 CVE-2026-44414 — Industrial Edge Cloud Device (IECD) 6.8 Medium 2026-10-13
CVE-2026-5703 Satel Iberia SenNet Datalogger Serie 200 路径遍历漏洞 — SenNet Datalogger Serie 200 7.1 High 2026-10-07
CVE-2026-105683 Ghost ImageSize 服务路径遍历漏洞 — Ghost 3.8 Low 2026-10-05
CVE-2026-103290 Ghost 6.14.0-6.27.0 ImageSize路径遍历漏洞 — Ghost 3.8 Low 2026-10-01
CVE-2026-82824 路径遍历导致任意文件读写删除漏洞 — Hitachi Coding Software Suite 9.8 Critical 2026-10-01
CVE-2026-97244 WordPress Creator LMS 1.2.19 路径遍历漏洞 — Creator LMS 7.5 High 2026-09-30
CVE-2026-27557 PHP路径遍历漏洞 — ICE2-8IOL1-G65L-V1D 7.5 High 2026-09-16
CVE-2026-85310 WordPress Groundhogg 路径遍历漏洞 — Groundhogg 6.5 Medium 2026-09-10
CVE-2026-20513 MediaTek Chipset 路径遍历漏洞 — MediaTek chipset - - 2026-09-07
CVE-2026-56089 Dell ObjectScale 路径遍历漏洞 — ObjectScale 3.3 Low 2026-08-17
CVE-2026-59909 Dell ObjectScale 路径遍历漏洞 — ObjectScale 7.1 High 2026-08-17
CVE-2026-28157 WordPress ToneDen Shortcode 路径遍历漏洞 — Do Lasso 7.5 High 2026-08-13
CVE-2026-69109 Siemens License Server 路径遍历漏洞 — Siemens License Server (SLS) 7.5 High 2026-08-11
CVE-2026-13716 Arcadia Crafty Controller 路径遍历漏洞 — Crafty Controller 9.1 Critical 2026-08-11
CVE-2026-59115 Microsoft Entra Provisioning Service 路径遍历漏洞 — Microsoft Entra Provisioning Service 9.9 Critical 2026-08-06
CVE-2026-66695 WordPress W3 Total Cache 路径遍历漏洞 — W3 Total Cache 6.5 Medium 2026-08-06
CVE-2025-59181 Ericsson Packet Core Controller 路径遍历漏洞 — Packet Core Controller (PCC) 4.8 Medium 2026-07-27
CVE-2026-49779 WordPress Tax Exempt for WooCommerce 路径遍历漏洞 — Tax Exempt for WooCommerce 6.5 Medium 2026-07-02
CVE-2026-52707 Mikado-Themes Kastell 路径遍历漏洞 — Kastell 8.1 High 2026-06-17
CVE-2026-52703 Ninja Team FastDup 路径遍历漏洞 — FastDup 9.6 Critical 2026-06-15
CVE-2026-49112 Tammersoft Shared Files 路径遍历漏洞 — Shared Files 7.5 High 2026-06-15
CVE-2026-42661 aguilatechnologies WP Customer Area 路径遍历漏洞 — WP Customer Area 8.8 High 2026-06-15
CVE-2026-40128 SAP NetWeaver Application Server Java 安全漏洞 — SAP NetWeaver Application Server Java (Web Container) 9.0 Critical 2026-06-09
CVE-2026-24315 SAP Fiori 安全漏洞 — SAP Fiori (launchpad) 4.2 Medium 2026-06-09
CVE-2026-44933 libzypp 安全漏洞 — SUSE Linux Enterprise 7.8 High 2026-05-20
CVE-2026-45495 Microsoft Edge 安全漏洞 — Microsoft Edge (Chromium-based) 8.8 High 2026-05-18
CVE-2026-24464 F5 BIG-IP 安全漏洞 — BIG-IP 6.8 Medium 2026-05-13

CWE-35（路径遍历：’…/…//’） 是常见的弱点类别，本平台收录该类弱点关联的 181 条 CVE 漏洞。