CWE-426 不可信的搜索路径 类弱点 249 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-426 属于不信任搜索路径漏洞，指程序使用外部提供的路径查找关键资源，导致可能访问不受控的文件。攻击者常通过操纵环境变量或配置，将恶意程序或数据注入搜索路径，从而执行任意代码或窃取敏感信息。开发者应避免使用动态搜索路径，改用硬编码的绝对路径，或严格验证路径来源及权限，确保仅加载受信任目录下的资源，以阻断攻击链。
#define DIR "/restricted/directory" char cmd[500]; sprintf(cmd, "ls -l %480s", DIR); /* Raise privileges to those needed for accessing DIR. */ RaisePrivileges(...); system(cmd); DropPrivileges(...); ...The user sets the PATH to reference a directory under the attacker's control, such as "/my/dir/". The attacker creates a malicious program called "ls", and puts that program in /my/dir The user executes the program. When system() is executed, the shell consults the PATH to find the ls program The program finds the attacker's malicious program, "/my/dir/ls". It doesn't find "/bin/ls" because PATH does not contain "/bin/". The program executes the attacker's malicious program with the raised privileges.... String home = System.getProperty("APPHOME"); String cmd = home + INITCMD; java.lang.Runtime.getRuntime().exec(cmd); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-3220 | CPython 安全漏洞 — CPython | 5.5 | - | 2025-02-14 |
| CVE-2025-24828 | Acronis Cyber Protect Cloud Agent 代码问题漏洞 — Acronis Cyber Protect Cloud Agent | 7.8 | - | 2025-01-31 |
| CVE-2025-24827 | Acronis Cyber Protect Cloud Agent 代码问题漏洞 — Acronis Cyber Protect Cloud Agent | 7.8 | - | 2025-01-31 |
| CVE-2025-24829 | Acronis Cyber Protect Cloud Agent 代码问题漏洞 — Acronis Cyber Protect Cloud Agent | 7.8 | - | 2025-01-31 |
| CVE-2025-24830 | Acronis Cyber Protect Cloud Agent 代码问题漏洞 — Acronis Cyber Protect Cloud Agent | 7.8 | - | 2025-01-31 |
| CVE-2025-0145 | Zoom Workplace 安全漏洞 — Zoom Workplace Apps for Windows | 4.6 | Medium | 2025-01-30 |
| CVE-2025-24789 | Snowflake JDBC 代码问题漏洞 — snowflake-jdbc | 7.8 | High | 2025-01-29 |
| CVE-2025-0733 | Postman 代码问题漏洞 — Postman | 4.5 | Medium | 2025-01-27 |
| CVE-2025-0732 | Discord 代码问题漏洞 — Discord | 4.5 | Medium | 2025-01-27 |
| CVE-2025-0707 | Rise Mode Temp CPU 代码问题漏洞 — Rise Mode Temp CPU | 7.8 | High | 2025-01-24 |
| CVE-2024-13524 | OBS Studio 代码问题漏洞 — OBS Studio | 4.5 | Medium | 2025-01-20 |
| CVE-2025-0567 | Epic Games Launcher 代码问题漏洞 — Launcher | 4.5 | Medium | 2025-01-19 |
| CVE-2025-21399 | Microsoft Edge 安全漏洞 — Microsoft Edge Update Setup | 7.4 | High | 2025-01-17 |
| CVE-2020-8094 | Bitdefender Antivirus Free 代码问题漏洞 — Antivirus Free 2020 | 7.3 | - | 2025-01-15 |
| CVE-2025-21365 | Microsoft Office 代码问题漏洞 — Microsoft 365 Apps for Enterprise | 7.8 | High | 2025-01-14 |
| CVE-2024-13158 | Ivanti EPM 安全漏洞 — Endpoint Manager | 7.2 | High | 2025-01-14 |
| CVE-2025-0459 | RetroArch 代码问题漏洞 — RetroArch | 5.3 | Medium | 2025-01-14 |
| CVE-2024-53866 | pnpm 代码问题漏洞 — pnpm | 9.8 | - | 2024-12-10 |
| CVE-2024-11454 | Autodesk Revit 安全漏洞 — Revit | 7.8 | High | 2024-12-09 |
| CVE-2023-1521 | SUSE Linux Enterprise Server for SAP Applications 安全漏洞 — sccache | 7.4 | - | 2024-11-26 |
| CVE-2024-49515 | Adobe Substance 3D Painter 代码问题漏洞 — Substance3D - Painter | 7.8 | High | 2024-11-12 |
| CVE-2024-36507 | Fortinet FortiClientWindows 安全漏洞 — FortiClientWindows | 6.7 | High | 2024-11-12 |
| CVE-2024-49043 | Microsoft SQL Server 代码问题漏洞 — Microsoft SQL Server 2017 (GDR) | 7.8 | High | 2024-11-12 |
| CVE-2024-7995 | Autodesk VRED Design 安全漏洞 — VRED Design | 7.8 | High | 2024-11-05 |
| CVE-2023-32266 | OpenText Application Lifecycle Management 代码问题漏洞 — Application Lifecycle Management (ALM),Quality Center | 7.3AI | High AI | 2024-10-16 |
| CVE-2024-47422 | Adobe Framemaker 代码问题漏洞 — Adobe Framemaker | 7.8 | High | 2024-10-09 |
| CVE-2024-43616 | Microsoft Office 代码问题漏洞 — Microsoft 365 Apps for Enterprise | 7.8 | High | 2024-10-08 |
| CVE-2024-43576 | Microsoft Office 代码问题漏洞 — Microsoft 365 Apps for Enterprise | 7.8 | High | 2024-10-08 |
| CVE-2024-8733 | HP One Agent Software 安全漏洞 — HP One Agent Software | 8.0 | High | 2024-10-02 |
| CVE-2024-6769 | Microsoft多款产品 安全漏洞 — Windows 10 | 6.7 | Medium | 2024-09-26 |
CWE-426（不可信的搜索路径） 是常见的弱点类别，本平台收录该类弱点关联的 249 条 CVE 漏洞。