CWE-641: Improper Restriction of Names for Files and Other Resources
Filter
The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
What the weakness is: CWE-641 at MITRE. All weaknesses
Ask an AI about CWE-641
Show the prompt
Explain CWE-641: Improper Restriction of Names for Files and Other Resources and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/641.html and https://cve.bz/cve/cwe/641?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2026-85864EPSS 0.3%
Improper privilege management in Python allows an authorized attacker to elevate privileges locally.
- 4.9CVE-2026-20282EPSS 0.6%
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An …
- 7.5CVE-2026-46581EPSS 0.6%
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as pa…
- 7.8CVE-2026-50510EPSS 0.4%
Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.
- 9.6CVE-2026-50023EPSS 0.7%
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing…
- 8.8CVE-2026-27140EPSS 0.7%
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
- 6.9CVE-2019-25623EPSS 0.2%
Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can create a text file with arbitrary character se…
- 8.8CVE-2026-25177EPSS 1.4%
Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
- 8.4CVE-2025-47953EPSS 0.6%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-47173EPSS 0.6%
Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.
- 6.5CVE-2024-47260EPSS 0.4%
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips then designed resulting in the Axis device running out of memo…
- 7.8CVE-2025-21402EPSS 0.7%
Microsoft Office OneNote Remote Code Execution Vulnerability
- 7.8CVE-2025-21361EPSS 0.8%
Microsoft Outlook Remote Code Execution Vulnerability
- 5.3CVE-2024-45312EPSS 0.5%
Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vulnerability that allows an arbitrary language parameter in client spelling reque…
- 6.7CVE-2024-30063EPSS 1.0%
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
- 7.2CVE-2023-0046EPSS 1.1%
Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
- 6.5CVE-2022-23536EPSS 0.8%
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing malici…
- 5.4CVE-2022-36302EPSS 0.6%
File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access different resources, which may contain sensitive information.
- 8.8CVE-2021-41146EPSS 1.5%
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially cr…