目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-426 不可信的搜索路径 类漏洞列表 229

CWE-426 不可信的搜索路径 类弱点 229 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-426 属于不信任搜索路径漏洞，指程序使用外部提供的路径查找关键资源，导致可能访问不受控的文件。攻击者常通过操纵环境变量或配置，将恶意程序或数据注入搜索路径，从而执行任意代码或窃取敏感信息。开发者应避免使用动态搜索路径，改用硬编码的绝对路径，或严格验证路径来源及权限，确保仅加载受信任目录下的资源，以阻断攻击链。

MITRE CWE 官方描述
CWE：CWE-426 不受信任的搜索路径 (Untrusted Search Path) 英文：该产品使用外部提供的搜索路径来搜索关键资源，该路径可能指向不受该产品直接控制的资源。 这可能导致攻击者执行其自己的程序、访问未经授权的数据文件或以意外方式修改配置。如果产品使用搜索路径来定位关键资源（如程序），则攻击者可以修改该搜索路径以指向恶意程序，目标产品随后将执行该程序。此问题扩展到产品所信任的任何类型的关键资源。不受信任的搜索路径的一些最常见变体包括：在各种 UNIX 和基于 Linux 的系统中，可能会查阅 PATH 环境变量来定位可执行程序，并使用 LD_PRELOAD 来定位单独的库。在各种基于 Microsoft 的系统中，如果未在其他出现在搜索顺序前面的路径中找到 DLL，则会查阅 PATH 环境变量来定位 DLL。
常见影响 (3)
Integrity, Confidentiality, Availability, Access Control Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
There is the potential for arbitrary code execution with privileges of the vulnerable program.
Availability DoS: Crash, Exit, or Restart
The program could be redirected to the wrong files, potentially triggering a crash or hang when the targeted file is too large or does not have the expected format.
Confidentiality Read Files or Directories
The program could send the output of unauthorized files to the attacker.
缓解措施 (5)
Architecture and Design, Implementation Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Implementation When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code ref…
Implementation Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Implementation Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
Implementation Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
代码示例 (2)
This program is intended to execute a command that lists the contents of a restricted directory, then performs other actions. Assume that it runs with setuid privileges in order to bypass the permissions check by the operating system.
#define DIR "/restricted/directory" char cmd[500]; sprintf(cmd, "ls -l %480s", DIR); /* Raise privileges to those needed for accessing DIR. */ RaisePrivileges(...); system(cmd); DropPrivileges(...); ...
Bad · C
The user sets the PATH to reference a directory under the attacker's control, such as "/my/dir/". The attacker creates a malicious program called "ls", and puts that program in /my/dir The user executes the program. When system() is executed, the shell consults the PATH to find the ls program The program finds the attacker's malicious program, "/my/dir/ls". It doesn't find "/bin/ls" because PATH does not contain "/bin/". The program executes the attacker's malicious program with the raised privileges.
Attack
The following code from a system utility uses the system property APPHOME to determine the directory in which it is installed and then executes an initialization script based on a relative path from the specified directory.
... String home = System.getProperty("APPHOME"); String cmd = home + INITCMD; java.lang.Runtime.getRuntime().exec(cmd); ...
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-24051 OpenTelemetry-Go 代码问题漏洞 — opentelemetry-go 7.0 High 2026-02-02
CVE-2026-24070 Native Instruments Native Access 安全漏洞 — Native Access 5.5AI Medium AI 2026-02-02
CVE-2026-23512 sumatrapdf 代码问题漏洞 — sumatrapdf 8.6 High 2026-01-14
CVE-2026-21280 Adobe Illustrator 代码问题漏洞 — Illustrator 8.6 High 2026-01-13
CVE-2026-20943 Microsoft Office 代码问题漏洞 — Microsoft Office 2016 7.0 High 2026-01-13
CVE-2025-12793 ASUS System Control Interface 安全漏洞 — ASCI 7.3 - 2026-01-06
CVE-2019-25257 LogicalDOC Enterprise 安全漏洞 — LogicalDOC Enterprise 6.5 Medium 2025-12-24
CVE-2025-67722 FreePBX 代码问题漏洞 — framework 7.8AI High AI 2025-12-16
CVE-2025-64785 Adobe Acrobat Reader 代码问题漏洞 — Acrobat Reader 7.8 High 2025-12-09
CVE-2025-12819 PgBouncer 安全漏洞 — PgBouncer 7.5 High 2025-12-03
CVE-2025-49642 Zabbix Agent 安全漏洞 — Zabbix 7.8AI High AI 2025-12-01
CVE-2024-21923 AMD StoreMI 安全漏洞 — AMD StoreMI™ 7.3 High 2025-11-23
CVE-2024-21922 AMD StoreMI 安全漏洞 — AMD StoreMI™ 7.3 High 2025-11-23
CVE-2025-60718 Microsoft Windows 代码问题漏洞 — Windows 11 Version 24H2 7.8 High 2025-11-11
CVE-2025-43079 Qualys Cloud Agent 安全漏洞 — Qualys Agent 6.3 Medium 2025-11-10
CVE-2024-14012 Revenera InstallShield 安全漏洞 — InstallShield 7.8AI High AI 2025-10-29
CVE-2025-49457 Zoom Clients for Windows 安全漏洞 — Zoom Clients for Windows 9.6 Critical 2025-08-12
CVE-2025-49456 Zoom Clients for Windows 安全漏洞 — Zoom Clients for Windows 6.2 Medium 2025-08-12
CVE-2025-5039 Autodesk多款产品 安全漏洞 — AutoCAD 7.8 High 2025-07-24
CVE-2025-23266 NVIDIA Container Toolkit 代码问题漏洞 — Container Toolkit 9.0 Critical 2025-07-17
CVE-2025-0141 Palo Alto Networks GlobalProtect app 安全漏洞 — GlobalProtect App 7.8AI High AI 2025-07-09
CVE-2025-49124 Apache Tomcat 安全漏洞 — Apache Tomcat 7.8AI High AI 2025-06-16
CVE-2025-30399 Microsoft Visual Studio和Microsoft .NET 安全漏洞 — .NET 8.0 7.5 High 2025-06-13
CVE-2025-5335 Autodesk Installer 安全漏洞 — Installer 7.8 High 2025-06-10
CVE-2024-12168 Yandex Telemost 安全漏洞 — Telemost 7.8AI High AI 2025-06-02
CVE-2025-2501 Lenovo PC Manager 安全漏洞 — PC Manager 7.8 High 2025-05-30
CVE-2025-4971 Broadcom Automic Automation Agent 代码问题漏洞 — Automic Automation 7.8AI High AI 2025-05-19
CVE-2025-4802 GNU C Library 安全漏洞 — glibc 7.5AI High AI 2025-05-16
CVE-2024-58250 ppp 安全漏洞 — ppp 9.3 Critical 2025-04-22
CVE-2025-27743 Microsoft System Center Operations Manager 代码问题漏洞 — System Center Data Protection Manager 2019 7.8 High 2025-04-08

CWE-426（不可信的搜索路径） 是常见的弱点类别，本平台收录该类弱点关联的 229 条 CVE 漏洞。