CWE-641 Improper Restriction of Names for Files and Other Resources
baseThe product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (23)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-36326US | critical9.8 | — | ||
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because… | ||||
| CVE-2026-50023US | critical9.6 | — | ||
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .… | ||||
| CVE-2026-20284US | critical9.1 | — | ||
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks.
This vulnerability is due to insufficient valida… | ||||
| CVE-2022-40955US | high8.8 | — | ||
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL databas… | ||||
| CVE-2026-27140US | high8.8OT elevated | — | ||
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. | ||||
| CVE-2026-85864US | high7.8 | — | ||
Improper privilege management in Python allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50510US | high7.8 | — | ||
Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally. | ||||
| CVE-2023-0046US | high7.2 | — | ||
Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch. | ||||
| CVE-2021-41146US | medium6.8 | — | ||
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL… | ||||
| CVE-2026-20283US | medium6.5 | — | ||
A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. … | ||||
| CVE-2022-23536US | medium6.5 | — | ||
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor co… | ||||
| CVE-2019-25623US | medium5.5 | — | ||
Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. A… | ||||
| CVE-2022-36302US | medium5.4 | — | ||
File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access different resources, which may contain sens… | ||||
| CVE-2024-45312US | medium5.3 | — | ||
Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vulnerability that allo… | ||||
| CVE-2026-20282US | medium4.9 | — | ||
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device.
This vulnerability is… | ||||
| CVE-2026-25177US | — | Exploit | ||
Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-46581US | — | — | ||
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to… | ||||
| CVE-2025-47953US | — | — | ||
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-47173US | — | — | ||
Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2024-47260US | — | — | ||
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips the… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan