CWE-50: Path Equivalence: '//multiple/leading/slash'

Variant

The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Consequences

Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories

Recent advisories

GHSA-353f-5xf4-qw67 — Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

All advisories for CWE-50

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor