目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-35 路径遍历：’…/…//’ 类漏洞列表 181

CWE-35 路径遍历：’…/…//’ 类弱点 181 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-35 属于路径遍历漏洞，指程序使用外部输入构建受限目录内的文件路径时，未正确过滤“.../...//”等双重重定向序列。攻击者利用此缺陷，通过构造特殊路径字符序列绕过安全检查，访问或修改目录外的敏感文件。开发者应避免直接拼接用户输入，需对路径进行严格规范化处理，并实施白名单验证，确保最终解析路径始终位于预期的安全目录范围内。

MITRE CWE 官方描述
CWE：CWE-35 路径遍历：'.../...//' 英文：产品使用外部输入来构建一个应位于受限目录内的路径名，但它未能正确对 '.../...//'（双重重叠点斜杠）序列进行中和，这些序列可能解析到该目录之外的位置。
常见影响 (1)
Confidentiality, Integrity Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism
Not properly neutralizing '.../...//' (doubled triple dot slash) allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
缓解措施 (2)
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Effectiveness: High
Implementation Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
代码示例 (1)
Suppose the product serves files from a specific "public" directory -- /home/product/public/ -- and has an algorithm that attempts to protect against common path traversal attacks. The algorithm works by sequentially scanning through a requested filename and removes each occurrence of "../" that it encounters, then appending the filename to the public directory.
../secret.dat
Attack
/home/product/public/secret.dat
Result
CVE ID 标题 CVSS 风险等级 Published
CVE-2025-8051 OpenText Flipper 安全漏洞 — Flipper 6.5AI Medium AI 2025-10-20
CVE-2025-42937 SAP Print Service 安全漏洞 — SAP Print Service 9.8 Critical 2025-10-14
CVE-2025-43907 Dell PowerProtect Data Domain 安全漏洞 — PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release 6.5 Medium 2025-10-07
CVE-2025-20313 Cisco IOS XE 安全漏洞 — Cisco IOS XE Software 6.7 Medium 2025-09-24
CVE-2025-43886 Dell PowerProtect Data Manager 安全漏洞 — PowerProtect Data Manager 4.4 Medium 2025-09-10
CVE-2025-48317 WordPress plugin WooCommerce Payment Gateway for Saferpay 安全漏洞 — WooCommerce Payment Gateway for Saferpay 7.5 High 2025-09-05
CVE-2025-4956 WordPress plugin Pro Bulk Watermark 安全漏洞 — Pro Bulk Watermark Plugin for WordPress 4.3 Medium 2025-08-30
CVE-2025-48081 WordPress plugin Printeers Print & Ship 安全漏洞 — Printeers Print & Ship 5.3 Medium 2025-08-27
CVE-2025-53561 WordPress plugin Prevent files / folders access 安全漏洞 — Prevent files / folders access 6.5 Medium 2025-08-20
CVE-2025-52712 WordPress plugin Post and Page Builder by BoldGrid 安全漏洞 — Post and Page Builder by BoldGrid 4.2 Medium 2025-08-14
CVE-2025-8088 WinRAR 安全漏洞 — WinRAR 8.4 High 2025-08-08
CVE-2024-52885 Check Point Mobile Access 安全漏洞 — Check Point Mobile Access 5.0 Medium 2025-08-06
CVE-2025-53417 Delta Electronics DIAView 安全漏洞 — DIAView 7.5AI High AI 2025-08-05
CVE-2025-20320 Splunk Cloud Platform和Splunk Enterprise 安全漏洞 — Splunk Enterprise 6.3 Medium 2025-07-07
CVE-2025-52805 WordPress plugin Leyka 安全漏洞 — Leyka 7.5 High 2025-07-04
CVE-2025-52810 WordPress plugin Katerio - Magazine 安全漏洞 — Katerio - Magazine 8.1 High 2025-06-27
CVE-2025-52811 WordPress plugin Davenport - Versatile Blog and Magazine WordPress Theme 安全漏洞 — Davenport - Versatile Blog and Magazine WordPress Theme 8.1 High 2025-06-27
CVE-2025-49451 WordPress plugin Aeroscroll Gallery 安全漏洞 — Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery 7.5 High 2025-06-17
CVE-2025-47176 Microsoft Outlook 安全漏洞 — Microsoft 365 Apps for Enterprise 7.8 High 2025-06-10
CVE-2025-30515 CyberData 011209 Intercom 安全漏洞 — 011209 SIP Emergency Intercom 9.8 Critical 2025-06-09
CVE-2025-39475 WordPress plugin Arlo 安全漏洞 — Arlo 8.1 High 2025-06-09
CVE-2025-49296 WordPress plugin GrandPrix 安全漏洞 — GrandPrix 8.1 High 2025-06-09
CVE-2025-49295 WordPress plugin MediClinic 安全漏洞 — MediClinic 8.1 High 2025-06-09
CVE-2025-49297 WordPress plugin Grill and Chow 安全漏洞 — Grill and Chow 8.1 High 2025-06-09
CVE-2025-27445 RSJoomla! RSFirewall! 安全漏洞 — RSFirewall component for Joomla 6.5AI Medium AI 2025-06-05
CVE-2025-5598 Airleader Master 安全漏洞 — airleader MASTER 7.5AI High AI 2025-06-04
CVE-2025-46441 WordPress plugin Section Widget 安全漏洞 — Section Widget 5.3 Medium 2025-05-19
CVE-2025-27010 WordPress plugin Tastyc 安全漏洞 — Tastyc 8.1 High 2025-05-19
CVE-2025-39492 WordPress plugin WHMpress 安全漏洞 — WHMpress 7.5 High 2025-05-16
CVE-2025-39491 WordPress plugin WHMpress 安全漏洞 — WHMpress 8.1 High 2025-05-16

CWE-35（路径遍历：’…/…//’） 是常见的弱点类别，本平台收录该类弱点关联的 181 条 CVE 漏洞。