CWE-426 不可信的搜索路径 类弱点 249 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-426 属于不信任搜索路径漏洞，指程序使用外部提供的路径查找关键资源，导致可能访问不受控的文件。攻击者常通过操纵环境变量或配置，将恶意程序或数据注入搜索路径，从而执行任意代码或窃取敏感信息。开发者应避免使用动态搜索路径，改用硬编码的绝对路径，或严格验证路径来源及权限，确保仅加载受信任目录下的资源，以阻断攻击链。
#define DIR "/restricted/directory" char cmd[500]; sprintf(cmd, "ls -l %480s", DIR); /* Raise privileges to those needed for accessing DIR. */ RaisePrivileges(...); system(cmd); DropPrivileges(...); ...The user sets the PATH to reference a directory under the attacker's control, such as "/my/dir/". The attacker creates a malicious program called "ls", and puts that program in /my/dir The user executes the program. When system() is executed, the shell consults the PATH to find the ls program The program finds the attacker's malicious program, "/my/dir/ls". It doesn't find "/bin/ls" because PATH does not contain "/bin/". The program executes the attacker's malicious program with the raised privileges.... String home = System.getProperty("APPHOME"); String cmd = home + INITCMD; java.lang.Runtime.getRuntime().exec(cmd); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-41840 | Fortinet FortiClient 安全漏洞 — FortiClientWindows | 7.4 | High | 2023-11-14 |
| CVE-2023-36393 | Microsoft Windows User Interface 安全漏洞 — Windows 10 Version 1809 | 7.8 | High | 2023-11-14 |
| CVE-2023-36422 | Microsoft Windows Defender 安全漏洞 — Windows Defender Antimalware Platform | 7.8 | High | 2023-11-14 |
| CVE-2021-26738 | Zscaler Client Connector 代码问题漏洞 — Client Connector | 7.8 | High | 2023-10-23 |
| CVE-2023-36780 | Microsoft Skype for Business Server 安全漏洞 — Skype for Business Server 2019 CU7 | 7.2 | High | 2023-10-10 |
| CVE-2023-36778 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2019 Cumulative Update 13 | 8.0 | High | 2023-10-10 |
| CVE-2023-41766 | Microsoft Client Server Run-time Subsystem 安全漏洞 — Windows 10 Version 1809 | 7.8 | High | 2023-10-10 |
| CVE-2023-39201 | Zoom Client 代码问题漏洞 — CleanZoom | 7.2 | High | 2023-09-12 |
| CVE-2023-4736 | Vim 代码问题漏洞 — vim/vim | 7.8 | - | 2023-09-02 |
| CVE-2023-40590 | GitPython 代码问题漏洞 — GitPython | 7.8 | High | 2023-08-28 |
| CVE-2023-29299 | Adobe Acrobat Reader 代码问题漏洞 — Acrobat Reader | 4.7 | Medium | 2023-08-10 |
| CVE-2023-36898 | Microsoft Tablet Windows User Interface 安全漏洞 — Windows 11 version 21H2 | 7.8 | High | 2023-08-08 |
| CVE-2023-36540 | Zoom Client 代码问题漏洞 — Zoom Desktop Client for Windows | 7.3 | High | 2023-08-08 |
| CVE-2023-36538 | Zoom Rooms 安全漏洞 — Zoom Rooms for Windows | 8.4 | High | 2023-07-11 |
| CVE-2023-36536 | Zoom Rooms 代码问题漏洞 — Zoom Rooms for Windows | 8.2 | High | 2023-07-11 |
| CVE-2023-34119 | Zoom Rooms 安全漏洞 — Zoom Rooms for Windows | 8.2 | High | 2023-07-11 |
| CVE-2023-35343 | Microsoft Windows Geolocation Service 安全漏洞 — Windows 10 Version 1809 | 7.8 | High | 2023-07-11 |
| CVE-2023-28143 | Qualys Cloud Agent 代码问题漏洞 — Cloud Agent | 6.7 | Medium | 2023-04-18 |
| CVE-2023-26358 | Adobe Creative Cloud Desktop Application 代码问题漏洞 — Creative Cloud (desktop component) | 8.6 | High | 2023-03-22 |
| CVE-2023-26038 | ZoneMinder 代码问题漏洞 — zoneminder | 5.4 | Medium | 2023-02-25 |
| CVE-2023-26036 | ZoneMinder 代码问题漏洞 — zoneminder | 8.1 | High | 2023-02-25 |
| CVE-2023-23920 | Node.js 代码问题漏洞 — Node | 5.8 | - | 2023-02-23 |
| CVE-2023-22743 | Git 代码问题漏洞 — git | 7.3 | High | 2023-02-14 |
| CVE-2023-23618 | Git 代码问题漏洞 — git | 8.6 | High | 2023-02-14 |
| CVE-2022-35868 | Siemens TIA Multiuser Server 代码问题漏洞 — TIA Multiuser Server V14 | 6.7 | Medium | 2023-02-14 |
| CVE-2022-4883 | libXpm 代码问题漏洞 — libXpm | 8.8 | - | 2023-02-07 |
| CVE-2022-41953 | Git 代码问题漏洞 — git | 8.6 | High | 2023-01-17 |
| CVE-2023-21764 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2019 Cumulative Update 11 | 7.8 | High | 2023-01-10 |
| CVE-2023-21763 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2019 Cumulative Update 11 | 7.8 | High | 2023-01-10 |
| CVE-2022-31253 | openSUSE openldap2代码问题漏洞 — Factory | 7.1 | High | 2022-11-09 |
CWE-426（不可信的搜索路径） 是常见的弱点类别，本平台收录该类弱点关联的 249 条 CVE 漏洞。