Path Equivalence: 'fakedir/../realdir/filename'

Properties

id: d3f:CWE-57

name: Path Equivalence: 'fakedir/../realdir/filename'
definition: The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.

CWE-57 has no direct neighbors in this release.

This page is experimental and may change significantly in future releases.

No related defensive techniques in this release.

CWE-57 has no related weaknesses in this release.

No related offensive techniques in this release.