CWE-426 不可信的搜索路径 类弱点 229 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-426 属于不信任搜索路径漏洞，指程序使用外部提供的路径查找关键资源，导致可能访问不受控的文件。攻击者常通过操纵环境变量或配置，将恶意程序或数据注入搜索路径，从而执行任意代码或窃取敏感信息。开发者应避免使用动态搜索路径，改用硬编码的绝对路径，或严格验证路径来源及权限，确保仅加载受信任目录下的资源，以阻断攻击链。
#define DIR "/restricted/directory" char cmd[500]; sprintf(cmd, "ls -l %480s", DIR); /* Raise privileges to those needed for accessing DIR. */ RaisePrivileges(...); system(cmd); DropPrivileges(...); ...The user sets the PATH to reference a directory under the attacker's control, such as "/my/dir/". The attacker creates a malicious program called "ls", and puts that program in /my/dir The user executes the program. When system() is executed, the shell consults the PATH to find the ls program The program finds the attacker's malicious program, "/my/dir/ls". It doesn't find "/bin/ls" because PATH does not contain "/bin/". The program executes the attacker's malicious program with the raised privileges.... String home = System.getProperty("APPHOME"); String cmd = home + INITCMD; java.lang.Runtime.getRuntime().exec(cmd); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-26036 | ZoneMinder 代码问题漏洞 — zoneminder | 8.1 | High | 2023-02-25 |
| CVE-2023-23920 | Node.js 代码问题漏洞 — Node | 5.8 | - | 2023-02-23 |
| CVE-2023-22743 | Git 代码问题漏洞 — git | 7.3 | High | 2023-02-14 |
| CVE-2023-23618 | Git 代码问题漏洞 — git | 8.6 | High | 2023-02-14 |
| CVE-2022-35868 | Siemens TIA Multiuser Server 代码问题漏洞 — TIA Multiuser Server V14 | 6.7 | Medium | 2023-02-14 |
| CVE-2022-4883 | libXpm 代码问题漏洞 — libXpm | 8.8 | - | 2023-02-07 |
| CVE-2022-41953 | Git 代码问题漏洞 — git | 8.6 | High | 2023-01-17 |
| CVE-2023-21764 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2019 Cumulative Update 11 | 7.8 | High | 2023-01-10 |
| CVE-2023-21763 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2019 Cumulative Update 11 | 7.8 | High | 2023-01-10 |
| CVE-2022-31253 | openSUSE openldap2代码问题漏洞 — Factory | 7.1 | High | 2022-11-09 |
| CVE-2022-3734 | Redis Labs Redis 代码问题漏洞 — Redis | 6.3 | Medium | 2022-10-28 |
| CVE-2022-0074 | Litespeed Technologie OpenLiteSpeed 代码问题漏洞 — OpenLiteSpeed Web Server | 8.8 | High | 2022-10-27 |
| CVE-2022-36070 | Poetry 代码问题漏洞 — poetry | 7.3 | High | 2022-09-07 |
| CVE-2022-31012 | Git for Windows 代码问题漏洞 — git | 8.2 | High | 2022-07-12 |
| CVE-2017-20123 | Sparklabs Viscosity 代码问题漏洞 — Viscosity | 8.8 | High | 2022-06-30 |
| CVE-2022-24826 | Git Lfs 代码问题漏洞 — git-lfs | 9.8 | Critical | 2022-04-19 |
| CVE-2022-0014 | Palo Alto Networks Cortex XDR 代码问题漏洞 — Cortex XDR Agent | 6.7 | Medium | 2022-01-12 |
| CVE-2011-4125 | Calibre 代码问题漏洞 — Calibre | 9.8 | - | 2021-10-27 |
| CVE-2021-36297 | SupportAssist Client 代码问题漏洞 — SupportAssist Client Consumer | 7.8 | High | 2021-09-28 |
| CVE-2021-31841 | Mcafee McAfee Agent 数据伪造问题漏洞 — McAfee Agent for Windows | 8.2 | High | 2021-09-22 |
| CVE-2021-37617 | Nextcloud Desktop Client 代码问题漏洞 — security-advisories | 7.3 | High | 2021-08-18 |
| CVE-2021-21562 | Dell Technologies Dell PowerScale OneFS代码问题漏洞 — PowerScale OneFS | 4.4 | Medium | 2021-08-02 |
| CVE-2021-25698 | Teradici PCoIP Standard Agent代码问题漏洞 — - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client | 7.8 | - | 2021-07-21 |
| CVE-2021-25699 | Teradici PCoIP Software Agent 代码问题漏洞 — - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client | 7.8 | - | 2021-07-21 |
| CVE-2021-21078 | Adobe Creative Cloud Desktop Application 代码问题漏洞 — Creative Cloud (desktop component) | 7.3 | - | 2021-03-12 |
| CVE-2021-21055 | Adobe Dreamweaver 代码问题漏洞 — Dreamweaver | 6.2 | Medium | 2021-02-11 |
| CVE-2021-21237 | Git Lfs 代码问题漏洞 — git-lfs | 7.2 | High | 2021-01-15 |
| CVE-2020-5144 | SonicWall Global VPN client 代码问题漏洞 — SonicWall Global VPN Client | 8.4 | - | 2020-10-28 |
| CVE-2020-6023 | Check Point ZoneAlarm 代码问题漏洞 — Check Point ZoneAlarm | 7.8 | - | 2020-10-27 |
| CVE-2020-8338 | Lenovo Diagnostics 代码问题漏洞 — Diagnostics | 7.8 | High | 2020-10-14 |
CWE-426（不可信的搜索路径） 是常见的弱点类别，本平台收录该类弱点关联的 229 条 CVE 漏洞。