CWE-57 Path Equivalence: 'fakedir/../realdir/filename'

variant

The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.

parent weaknesses

Broader classes this is a kind of.

CWE-41Improper Resolution of Path Equivalence

vulnerabilities (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2024-34995US	—	0.30% (23rd)	—	2024-05-24
svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserController#importOver. This vulnerability…

source

Where this definition is published.

MITREUS

scry

Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.

Free scan