Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CWE-38 (路径遍历：’absolutepathnamehere’) — Vulnerability Class 1

1 vulnerabilities classified as CWE-38 (路径遍历：’absolutepathnamehere’). AI Chinese analysis included.

MITRE CWE Description
The product accepts input in the form of a backslash absolute path ('\absolute\pathname\here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Common Consequences (1)
Confidentiality, IntegrityRead Files or Directories, Modify Files or Directories
Mitigations (2)
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Effectiveness: High
ImplementationInputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CVE IDTitleCVSSSeverityPublished
CVE-2026-9507 Session fixation vulnerability in Enhancesoft's osTicket — osTicket--2026-06-16

Vulnerabilities classified as CWE-38 (路径遍历：’absolutepathnamehere’) represent 1 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.