cve.bz

CAPEC-76

Manipulating Web Input to File System Calls

Very High severityHigh likelihoodDetailed pattern

An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-76: Manipulating Web Input to File System Calls: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/76.html and https://cve.bz/cve/capec/76?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Fingerprinting of the operating system] In order to create a valid file injection, the attacker needs to know what the underlying OS is so that the proper file seperator is used.

      3 techniques
      • Port mapping. Identify ports that the system is listening on, and attempt to identify inputs and protocol types on those ports.
      • TCP/IP Fingerprinting. The attacker uses various software to make connections or partial connections and observe idiosyncratic responses from the operating system. Using those responses, they attempt to guess the actual operating system.
      • Induce errors to find informative error messages

    2. [Survey the Application to Identify User-controllable Inputs] The attacker surveys the target application to identify all user-controllable inputs, possibly as a valid and authenticated user

      2 techniques
      • Spider web sites for all available links, entry points to the web site.
      • Manually explore application and inventory all application inputs

  2. Experiment

    They probe what they found.

    1. [Vary inputs, looking for malicious results] Depending on whether the application being exploited is a remote or local one, the attacker crafts the appropriate malicious input containing the path of the targeted file or other file system control syntax to be passed to the application

      3 techniques
      • Inject context-appropriate malicious file path using network packet injection tools (netcat, nemesis, etc.)
      • Inject context-appropriate malicious file path using web test frameworks (proxies, TamperData, custom programs, etc.) or simple HTTP requests
      • Inject context-appropriate malicious file system control syntax

  3. Exploit

    They carry out the attack.

    1. [Manipulate files accessible by the application] The attacker may steal information or directly manipulate files (delete, copy, flush, etc.)

      6 techniques
      • The attacker injects context-appropriate malicious file path to access the content of the targeted file.
      • The attacker injects context-appropriate malicious file system control syntax to access the content of the targeted file.
      • The attacker injects context-appropriate malicious file path to cause the application to create, delete a targeted file.
      • The attacker injects context-appropriate malicious file system control syntax to cause the application to create, delete a targeted file.
      • The attacker injects context-appropriate malicious file path in order to manipulate the meta-data of the targeted file.
      • The attacker injects context-appropriate malicious file system control syntax in order to manipulate the meta-data of the targeted file.

Prerequisites

  • Program must allow for user controlled variables to be applied directly to the filesystem

Skills required

  • Low skill

    To identify file system entry point and execute against an over-privileged system interface

Consequences

What a successful attack can lead to
ImpactAffectsNote
Gain PrivilegesConfidentiality, Access Control, Authorization
Modify DataIntegrity

Mitigations

  • Design: Enforce principle of least privilege.

  • Design: Ensure all input is validated, and does not contain file system commands

  • Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.

  • Design: For interactive user applications, consider if direct file system interface is necessary, instead consider having the application proxy communication.

  • Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.

Weaknesses it exploits

  • CWE-15 External Control of System or Configuration Setting
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-23 Relative Path Traversal
  • CWE-59 Improper Link Resolution Before File Access
  • CWE-73 External Control of File Name or Path
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
  • CWE-77 Improper Neutralization of Special Elements used in a Command
  • CWE-272 Least Privilege Violation
  • CWE-285 Improper Authorization
  • CWE-346 Origin Validation Error
  • CWE-348 Use of Less Trusted Source

Recent CVEs with these weaknesses

  1. 5.5CVE-2026-123181

    A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.

  2. 8.1CVE-2026-108187

    Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

  3. –CVE-2026-97881

    The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block ne…

  4. 8.2CVE-2026-125753

    ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can…

  5. –CVE-2026-86811

    The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or writt…

  6. 8.8CVE-2026-12573

    Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.

  7. 8.0CVE-2026-95646

    Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators …

  8. 2.1CVE-2026-124503

    A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack…

The newest records naming one of them. Each weakness's page lists them all.

Part of

Examples

The attacker uses relative path traversal to access files in the application. This is an example of accessing…

The attacker uses relative path traversal to access files in the application. This is an example of accessing user's password file.

http://www.example.com/getProfile.jsp?filename=../../../../etc/passwd

However, the target application employs regular expressions to make sure no relative path sequences are being passed through the application to the web page. The application would replace all matches from this regex with the empty string.

Then an attacker creates special payloads to bypass this filter:

http://www.example.com/getProfile.jsp?filename=%2e%2e/%2e%2e/%2e%2e/%2e%2e /etc/passwd

When the application gets this input string, it will be the desired vector by the attacker.

MITRE's words, unchanged: CAPEC-76 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.