CWE-797 (仅在一个绝对路径位置过滤特殊元素) — Vulnerability Class 1

1 vulnerabilities classified as CWE-797 (仅在一个绝对路径位置过滤特殊元素). AI Chinese analysis included.

MITRE CWE Description

The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component.

Common Consequences (1)

Integrity Unexpected State

Examples (1)

The following code takes untrusted input and uses a substring function to filter a 3-character "../" element located at the 0-index position of the input string. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.

my $Username = GetUntrustedInput(); if (substr($Username, 0, 3) eq '../') { $Username = substr($Username, 3); } my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);

Bad · Perl

../../../etc/passwd

Attack

CVE ID	Title	CVSS	Severity	Published
CVE-2026-59107	Shared SSH Authentication Key in vSolution Matrix File Sharing — Cynap Pro, Cynap Core Pro	9.8	Critical	2026-10-26

Vulnerabilities classified as CWE-797 (仅在一个绝对路径位置过滤特殊元素) represent 1 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.