CWE-706: Use of Incorrectly-Resolved Name or Reference

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Consequences

• Confidentiality, Integrity: Read Application Data, Modify Application Data

Recent advisories

• GHSA-69hj-f68j-2879 — filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
• GHSA-c48m-32m9-vx93 — vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
• GHSA-568f-pv23-39p4 — NLTK: Stable FrameNet and NKJP readers parse outside-root XML
• GHSA-7rc3-g7h6-22m7 — File Browser: Colliding username normalization gives two users the same home directory
• GHSA-8788-j68r-3cgh — Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
• GHSA-jp82-jpqv-5vv3 — Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
• GHSA-w727-595x-pc3r — pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
• GHSA-6jwx-7vp4-9847 — Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync
• GHSA-57j5-qwp2-vqp6 — OpenFGA has Improper Policy Enforcement
• GHSA-rxmx-g7hr-8mx4 — OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders
• GHSA-hhq4-97c2-p447 — OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass
• GHSA-rqp8-q22p-5j9q — OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision
• GHSA-qm9x-v7cx-7rq4 — OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
• GHSA-wv46-v6xc-2qhf — OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.
• GHSA-2j6q-whv2-gh6w — h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

All advisories for CWE-706