CWE-42: Path Equivalence: 'filename.' (Trailing Dot)

Variant

The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Consequences

Access Control: Bypass Protection Mechanism

Recent advisories

GHSA-6q4g-84f3-mw74 — Improper handling of equivalent directory names on Windows in Jenkins

All advisories for CWE-42

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor