CWE-41 Improper Resolution of Path Equivalence
baseThe product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (50)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-21332US | high8.8 | — | ||
MapUrlToZone Security Feature Bypass Vulnerability | ||||
| CVE-2026-88136US | high8.8 | — | ||
Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-108463US | high8.8 | — | ||
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-102217US | high8.8 | — | ||
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-49401US | high8.4 | — | ||
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path… | ||||
| CVE-2015-5252US | high7.2 | — | ||
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers t… | ||||
| CVE-2026-112343US | high8.1 | — | ||
Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insens… | ||||
| CVE-2026-5816US | high8.1 | — | ||
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute… | ||||
| CVE-2023-36396US | high7.8 | — | ||
Windows Compressed Folder Remote Code Execution Vulnerability | ||||
| CVE-2019-16884US | high7.5OT erhöht | — | ||
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount ta… | ||||
| CVE-2026-70184US | high7.8 | — | ||
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102231US | high7.7 | — | ||
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-34426US | high7.3 | — | ||
OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allo… | ||||
| CVE-2019-19921US | high7.0 | — | ||
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn… | ||||
| CVE-2019-15845US | medium6.5 | — | ||
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions. | ||||
| CVE-2023-46169US | medium6.5 | — | ||
IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily delete a file. IBM X-Force ID: 269406.
| ||||
| CVE-2022-0855US | medium6.1 | — | ||
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4. | ||||
| CVE-2026-34451US | medium5.4 | — | ||
Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.81.0, the local filesyst… | ||||
| CVE-2025-58290US | medium5.5 | — | ||
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2024-6839US | medium5.3 | — | ||
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching path… | ||||
04
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan