Skip to content
Log inStart free trial

CWE-44: Path Equivalence: 'file.name' (Internal Dot)

Variant

The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Consequences

  • Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories

Recent advisories

  • GHSA-83qj-6fr2-vhqg — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

All advisories for CWE-44

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor