CVE:CVE-2011-4675
CNNVD:CNNVD-201112-031
Widelands 15.1之前版本的io/filesystem/filesystem.cc的路径名规范化功能中存在漏洞。当其引导~（波浪号）扩展到主目录路径名，并且对从网络接收到的字符串中的字符使用没有限制时，远程攻击者可以借助网游文件转换器使用的路径名中的 “~ ”来执行绝对路径遍历攻击和覆盖任意文件。
solution:Upgrade widelands widelands to a higher version than -:build1,-:build10,-:build10_release_candidate,-:build11,-:build11_release_candidate,-:build12,-:build12_release_candidate,-:build13,-:build13_release_candidate,-:build13_release_candidate2,-:build14,-:build14_release_candidate,-:build2,-:build3,-:build4,-:build5,-:build6,-:build7,-:build8,-:build9,and avoid the version -:build1,-:build10,-:build10_release_candidate,-:build11,-:build11_release_candidate,-:build12,-:build12_release_candidate,-:build13,-:build13_release_candidate,-:build13_release_candidate2,-:build14,-:build14_release_candidate,-:build2,-:build3,-:build4,-:build5,-:build6,-:build7,-:build8,-:build9