路径遍历

用 ../ 走出预期的目录。文件下载、解压和模板加载是重灾区。

影响

读取服务器上的任意文件，包括源码与配置中的密钥

观察点

响应中返回了 /etc/passwd 等预期目录之外的文件内容

修复

对路径做规范化后校验前缀，使用 ID 映射代替用户提供的文件名，并在解压时校验每个条目。

弱点分布

• 路径遍历243
• Unlabeled21
• Path Traversal: '.../...//'6
• External Control of File Name or Path5
• 违反安全设计原则（按标题归类）4
• Relative Path Traversal3
• File Manipulation1
• Improper Link Resolution Before File Access ('Link Following')1
• Path Traversal: 'dir\..\..\filename'1
• PHP Local File Inclusion1

共现类别

暂无共现数据。

高票报告

当前状态 286 份 · 全部 286 · 筛选赏金 $141,849

1. 1,503
   Arbitrary file read via the UploadsRewriter when moving and issueGitLab · 2020-04-28 · 严重
   $20,000路径遍历
2. 329
   Arbitrary file read via the bulk imports UploadsPipelineGitLab · 2022-03-21 · 严重
   $29,000路径遍历
3. 239
   Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataStarbucks · 2020-06-17 · 严重
   $0路径遍历
4. 194
   Arbitrary file read during project importGitLab · 2021-05-24 · 严重
   $16,000路径遍历
5. 176
   Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingPortSwigger Web Security · 2026-06-14 · 高危
   $5,000路径遍历
6. 175
   Path traversal in filename in LINE Mac clientLY Corporation · 2020-07-31 · 高危
   $0路径遍历
7. 173
   Mozilla VPN Clients: RCE via file write and path traversalMozilla · 2025-07-29 · 高危
   $6,000路径遍历
8. 164
   RCE as Admin defeats WordPress hardening and file permissionsWordPress · 2020-06-09 · 严重
   $0路径遍历
9. 146
   [portswigger.net] Path Traversal al /cms/audioitemsPortSwigger Web Security · 2024-04-04 · 高危
   $0路径遍历
10. 136
    Directory Traversal in uftpd 2.6-2.10██████ · — · 未评级
    $0Unlabeled
11. 119
    Wordpress unzip_file path traversalWordPress · 2020-01-30 · 中危
    $0违反安全设计原则（按标题归类）
12. 117
    Path Traversal Vulnerability in Lila ProjectLichess · 2025-06-09 · 高危
    $0Path Traversal: '.../...//'
13. 105
    Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file readAiven Ltd · 2021-12-14 · 高危
    $1,000路径遍历
14. 96
    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Internet Bug Bounty · 2021-11-10 · 严重
    $4,000路径遍历
15. 88
    Path traversal in Nuget Package RegistryGitLab · 2022-06-07 · 高危
    $12,000路径遍历
16. 88
    Avatar upload allows arbitrary file overwritingMail.ru · — · 未评级
    $750路径遍历
17. 84
    Vanilla Forums AddonManager getSingleIndex Directory Traversal File Inclusion Remote Code Execution VulnerabilityVanilla · — · 未评级
    $900路径遍历
18. 81
    Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/Starbucks · 2020-03-11 · 严重
    $0路径遍历
19. 80
    File writing by Directory traversal at actionpack-page_caching and RCE by itRuby on Rails · 2020-07-13 · 高危
    $1,000路径遍历
20. 76
    PUT Based CSRF via Client Side Path Traversal + Cookie Bomb on Acronis CloudAcronis · — · 未评级
    $600路径遍历
21. 74
    Path traversal lead to LFR via [CVE-2019-3394]Mail.ru · — · 未评级
    $0路径遍历
22. 74
    Local files reading from the web using `brave://`Brave Software · 2018-09-25 · 严重
    $0Unlabeled
23. 71
    CVE-█████-35813 in █████Mars · 2026-02-25 · 严重
    $0Relative Path Traversal
24. 70
    CVE-2020-3187 - Unauthenticated Arbitrary File DeletionU.S. Dept Of Defense · 2020-09-21 · 严重
    $0路径遍历
25. 69
    Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/`U.S. Dept Of Defense · 2024-10-26 · 高危
    $0路径遍历