Unverified50% confidenceSolutionExact time
At the CDN/WAF edge layer, known malicious paths should be blocked (such as `/.env`, `/.git/`, `wp-login.php`, `xmlrpc.php`, `/proc/self/`, `..;/`, or paths ending in `service-account.json`), but substring matches must always be tested with real URLs first to avoid mistakenly blocking legitimate pages.
1
Sources
50%
Confidence
Long-term
Relevance
10/13/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedPlacing relative paths (such as . or ./bin) in PATH brings security risks: when executing commands in an untrusted directory, a malicious program with the same name may be run unexpectedly.63% similarUnverifiedSSRF利用中常被检测的危险协议包括file://（读取本地文件）、dict://（探测端口开放状态）、ftp://（有时可绕过过滤）62% similarUnverifiedREA's inspect_web_network_capture tool can read HAR files offline or native mitmproxy captures on Linux, does not re-request the already-recorded URLs, and structurally excludes authorization headers, cookies, and credentials in URLs.62% similarUnverifiedv2.1.292 fixes a security issue where the PreToolUse hook approval and auto mode could bypass permission prompts when reading files from network (UNC) paths.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1016976API
curl https://kongchang.com/api/v1/knowledge/claims/1016976MCP
get_claim(id=1016976)