118 vulnerabilities classified as CWE-36 (绝对路径遍历). AI Chinese analysis included.
CWE-36 represents an absolute path traversal weakness where software fails to properly neutralize absolute path sequences, such as "/abs/path," when constructing file paths from external input. Attackers typically exploit this vulnerability by injecting absolute paths into user-controlled parameters, causing the application to resolve file locations outside the intended restricted directory. This allows unauthorized access to sensitive system files or directories that should remain inaccessible. To prevent such exploits, developers must rigorously validate and sanitize all user-supplied path inputs, ensuring they conform to expected formats and remain within designated boundaries. Implementing strict allow-lists for permitted directories and using secure API functions that inherently restrict path resolution can effectively mitigate this risk. Additionally, employing chroot jails or containerization further isolates file access, reducing the impact of any potential traversal attempts.
String filename = System.getProperty("com.domain.application.dictionaryFile"); File dictionaryFile = new File(filename);import os import sys def main(): filename = sys.argv[1] path = os.path.join(os.getcwd(), filename) try: with open(path, 'r') as f: file_data = f.read() except FileNotFoundError as e: print("Error - file not found") main()import os import sys def main(): filename = sys.argv[1] path = os.path.normpath(f"{os.getcwd()}{os.sep}{filename}") if path.startswith("/home/cwe/documents/"): try: with open(path, 'r') as f: file_data = f.read() except FileNotFoundError as e: print("Error - file not found") main()Vulnerabilities classified as CWE-36 (绝对路径遍历) represent 118 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.