VariantDraft
CWE-27Path Traversal: 'dir/../../filename'
Category: other
Description
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
Common consequences· 1
- Confidentiality / Integrity — Read Files or Directories, Modify Files or Directories
Potential mitigations· 2
- [Implementation]
- [Implementation]Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
References
(incoming)4
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Vulnerability | CVE-2025-10438cve-2025-10438 | 0% | live |
| Vulnerability | CVE-2025-66518cve-2025-66518 | 0% | live |
| Vulnerability | CVE-2026-24457cve-2026-24457 | 0% | live |
| KEVEntry | Jenkins Command Line Interface (CLI) Path Traversal Vulnerabilitykev-cve-2024-23897 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.