路径遍历

用 ../ 走出预期的目录。文件下载、解压和模板加载是重灾区。

影响

读取服务器上的任意文件，包括源码与配置中的密钥

观察点

响应中返回了 /etc/passwd 等预期目录之外的文件内容

修复

对路径做规范化后校验前缀，使用 ID 映射代替用户提供的文件名，并在解压时校验每个条目。

弱点分布

• 路径遍历243
• Unlabeled21
• Path Traversal: '.../...//'6
• External Control of File Name or Path5
• 违反安全设计原则（按标题归类）4
• Relative Path Traversal3
• File Manipulation1
• Improper Link Resolution Before File Access ('Link Following')1
• Path Traversal: 'dir\..\..\filename'1
• PHP Local File Inclusion1

共现类别

暂无共现数据。

高票报告

当前状态 233 份 · 全部 286 · 筛选赏金 $129,317

1. 1,503
   Arbitrary file read via the UploadsRewriter when moving and issueGitLab · 2020-04-28 · 严重
   $20,000路径遍历
2. 329
   Arbitrary file read via the bulk imports UploadsPipelineGitLab · 2022-03-21 · 严重
   $29,000路径遍历
3. 239
   Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataStarbucks · 2020-06-17 · 严重
   $0路径遍历
4. 194
   Arbitrary file read during project importGitLab · 2021-05-24 · 严重
   $16,000路径遍历
5. 176
   Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingPortSwigger Web Security · 2026-06-14 · 高危
   $5,000路径遍历
6. 175
   Path traversal in filename in LINE Mac clientLY Corporation · 2020-07-31 · 高危
   $0路径遍历
7. 173
   Mozilla VPN Clients: RCE via file write and path traversalMozilla · 2025-07-29 · 高危
   $6,000路径遍历
8. 164
   RCE as Admin defeats WordPress hardening and file permissionsWordPress · 2020-06-09 · 严重
   $0路径遍历
9. 146
   [portswigger.net] Path Traversal al /cms/audioitemsPortSwigger Web Security · 2024-04-04 · 高危
   $0路径遍历
10. 119
    Wordpress unzip_file path traversalWordPress · 2020-01-30 · 中危
    $0违反安全设计原则（按标题归类）
11. 117
    Path Traversal Vulnerability in Lila ProjectLichess · 2025-06-09 · 高危
    $0Path Traversal: '.../...//'
12. 105
    Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file readAiven Ltd · 2021-12-14 · 高危
    $1,000路径遍历
13. 96
    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Internet Bug Bounty · 2021-11-10 · 严重
    $4,000路径遍历
14. 88
    Path traversal in Nuget Package RegistryGitLab · 2022-06-07 · 高危
    $12,000路径遍历
15. 81
    Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/Starbucks · 2020-03-11 · 严重
    $0路径遍历
16. 80
    File writing by Directory traversal at actionpack-page_caching and RCE by itRuby on Rails · 2020-07-13 · 高危
    $1,000路径遍历
17. 74
    Local files reading from the web using `brave://`Brave Software · 2018-09-25 · 严重
    $0Unlabeled
18. 71
    CVE-█████-35813 in █████Mars · 2026-02-25 · 严重
    $0Relative Path Traversal
19. 70
    CVE-2020-3187 - Unauthenticated Arbitrary File DeletionU.S. Dept Of Defense · 2020-09-21 · 严重
    $0路径遍历
20. 69
    Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/`U.S. Dept Of Defense · 2024-10-26 · 高危
    $0路径遍历
21. 68
    jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`8x8 · 2026-07-02 · 低危
    $100路径遍历
22. 67
    Path traversal by monkey-patching Buffer internalsInternet Bug Bounty · 2024-05-29 · 高危
    $2,430路径遍历
23. 65
    Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)Basecamp · 2024-07-09 · 中危
    $0路径遍历
24. 63
    Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet LibraryNextcloud · 2025-10-16 · 中危
    $0路径遍历
25. 63
    Path Traversal Vulnerability found on IBM CloudIBM · 2025-05-08 · 严重
    $0路径遍历