cve.bz

CWE-73: External Control of File Name or Path, page 3

Filter

The product allows user input to control or influence paths or file names that are used in filesystem operations.

What the weakness is: CWE-73 at MITRE

Related attack patterns (CAPEC): 8
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-72 URL Encoding Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-73, as MITRE names them. Credits.

Ask an AI about CWE-73

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-73: External Control of File Name or Path and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/73.html and https://cve.bz/cve/cwe/73?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.3CVE-2026-54583EPSS 0.5%

    mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index dat…

  2. 6.0CVE-2026-54582EPSS 0.6%

    mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/inst…

  3. 6.0CVE-2026-92595EPSS 0.3%

    Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.resolveContent()` usin…

  4. 4.4CVE-2026-63225EPSS 0.2%

    Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples …

  5. 8.6CVE-2026-73171EPSS 0.5%

    Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite ar…

  6. 6.5CVE-2026-76553EPSS 0.5%

    The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Im…

  7. 5.1CVE-2026-76796EPSS 0.2%

    The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside…

  8. 7.7CVE-2026-73496EPSS 0.5%

    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/m…

  9. 7.5CVE-2026-54629EPSS 1.0%

    Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, aut…

  10. 9.1CVE-2026-50006EPSS 1.0%

    Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker …

  11. 8.8CVE-2026-16338EPSS 0.4%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.

  12. 8.7CVE-2026-90946EPSS 0.5%

    DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory …

  13. 8.6CVE-2026-90932EPSS 0.8%

    LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupService::deleteBackup()) concatenate the user-supplied backup_file/f…

  14. 9.6CVE-2026-77006EPSS 0.2%

    The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, s…

  15. 9.6CVE-2026-77005EPSS 0.4%

    The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a sub…

  16. 4.6CVE-2026-49836EPSS 0.2%

    psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled an…

  17. 9.3CVE-2026-88899EPSS 0.8%

    knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root …

  18. 5.4CVE-2026-53956EPSS 0.3%

    Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package …

  19. 8.4CVE-2026-86751EPSS 0.4%

    Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout …

  20. 8.4CVE-2026-86741EPSS 0.4%

    Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to lo…

  21. 8.4CVE-2026-87815EPSS 0.5%

    SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitra…

  22. 7.3CVE-2026-79692EPSS 0.3%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentiall…

  23. 9.0CVE-2026-53581EPSS 0.5%

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arb…

  24. 5.3CVE-2026-86995EPSS 0.4%

    n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration withou…

  25. 4.9CVE-2026-78620EPSS 0.3%

    The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files bei…

  26. 9.8CVE-2026-66302EPSS 1.0%

    External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.

  27. 8.1CVE-2026-69805EPSS 0.5%

    External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.

  28. 7.0CVE-2026-69383EPSS 0.4%

    External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally.

  29. 8.8CVE-2026-69355EPSS 0.9%

    External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

  30. 7.8CVE-2026-62804EPSS 0.6%

    External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  31. 5.6CVE-2026-81830EPSS 0.2%

    The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation

  32. 9.3CVE-2026-86189EPSS 0.7%

    WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can …

  33. 7.2CVE-2026-79426EPSS 0.5%

    An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request.

  34. 8.5CVE-2026-80119EPSS 0.2%

    PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dum…

  35. 8.4CVE-2026-80118EPSS 0.2%

    PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users throu…

  36. 8.7CVE-2026-85687EPSS 0.5%

    surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying a…

  37. 8.8CVE-2026-85684EPSS 1.1%

    marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences …

  38. 8.7CVE-2026-85668EPSS 0.6%

    Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model_path parameter without authentication or…

  39. 7.1CVE-2026-85603EPSS 0.6%

    Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply director…

  40. 5.5CVE-2026-82194EPSS 0.3%

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files o…

  41. 5.9CVE-2026-81347EPSS 0.4%

    The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outs…

  42. 6.5CVE-2026-75602EPSS 0.7%

    OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-…

  43. 8.7CVE-2026-85176EPSS 0.6%

    DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and a…

  44. 7.2CVE-2026-85160EPSS 0.4%

    AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concate…

  45. 6.9CVE-2026-84478EPSS 0.6%

    WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can…

  46. 7.5CVE-2026-84374EPSS 0.8%

    Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::st…

  47. 7.3CVE-2026-73770EPSS 0.2%

    An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the attacker's control and following a required action by another…

  48. 7.2CVE-2026-73720EPSS 1.1%

    Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privile…

  49. 7.2CVE-2026-73719EPSS 0.7%

    An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to…

  50. 7.5CVE-2026-82393EPSS 0.6%

    pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for u…