cve.bz

CWE-42: Path Equivalence: 'filename.' (Trailing Dot)

Filter

The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

What the weakness is: CWE-42 at MITRE. All weaknesses

Ask an AI about CWE-42

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-42: Path Equivalence: 'filename.' (Trailing Dot) and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/42.html and https://cve.bz/cve/cwe/42?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-52884EPSS 0.2%

    Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with truste…