CWE-57: Path Equivalence: 'fakedir/../realdir/filename'
Filter
The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.
What the weakness is: CWE-57 at MITRE. All weaknesses
Ask an AI about CWE-57
Show the prompt
Explain CWE-57: Path Equivalence: 'fakedir/../realdir/filename' and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/57.html and https://cve.bz/cve/cwe/57?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 4.3CVE-2024-34995EPSS 0.3%
svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserController#importOver. This vulnerability allows attackers to delete arbitrary files via a crafted P…