CWE-610: Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Consequences

• Confidentiality, Integrity: Read Application Data, Modify Application Data
• Access Control: Gain Privileges or Assume Identity

Recent advisories

• GHSA-wjgm-6hv5-3cvf — jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
• GHSA-55cf-xx38-4p9p — OpenClaw: Workspace dotenv files cannot override connector endpoint hosts
• GHSA-45cg-2683-gfmq — OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
• GHSA-f43r-cc68-gpx4 — External Control of File Name or Path in Langflow
• CVE-2025-0111 — An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web…
• GHSA-25qx-vfw2-fw8r — Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking
• GHSA-5mqx-rpxv-mvxj — HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration
• GHSA-mpwp-42x6-4wmx — Grafana Fine-grained access control vulnerability
• GHSA-c866-8gpw-p3mv — HashiCorp Nomad vulnerable to symlink attacks
• GHSA-22gj-8qj2-fj46 — Moodle External Control of File Name or Path vulnerability
• CVE-2022-27593 — An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station.
• GHSA-6m27-7cqj-2mxw — Shopware XXE Vulnerability
• GHSA-vw47-mr44-3jf9 — Confused Deputy in Kubernetes
• GHSA-74j8-88mm-7496 — Confused Deputy in Kubernetes
• GHSA-x3cc-x39p-42qx — Druid ingestion system Authenticated users can read data from other sources than intended

All advisories for CWE-610