VariantIncomplete

CWE-35Path Traversal: '.../...//'

Category: other

Description

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Common consequences· 1

  • Confidentiality / Integrity — Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism
    Not properly neutralizing '.../...//' (doubled triple dot slash) allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

Potential mitigations· 2

  • [Implementation]
  • [Implementation]Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

References

  1. https://cwe.mitre.org/data/definitions/35.html

(incoming)30

TypeTargetConfidenceTier
VulnerabilityCVE-2025-22786cve-2025-227860%live
VulnerabilityCVE-2025-24685cve-2025-246850%live
VulnerabilityCVE-2025-24786cve-2025-247860%live
VulnerabilityCVE-2025-25122cve-2025-251220%live
VulnerabilityCVE-2025-26935cve-2025-269350%live
VulnerabilityCVE-2025-27010cve-2025-270100%live
VulnerabilityCVE-2025-27222cve-2025-272220%live
VulnerabilityCVE-2025-30515cve-2025-305150%live
VulnerabilityCVE-2025-39467cve-2025-394670%live
VulnerabilityCVE-2025-39470cve-2025-394700%live
VulnerabilityCVE-2025-39475cve-2025-394750%live
VulnerabilityCVE-2025-39491cve-2025-394910%live
VulnerabilityCVE-2025-41723cve-2025-417230%live
VulnerabilityCVE-2025-41736cve-2025-417360%live
VulnerabilityCVE-2025-42937cve-2025-429370%live
VulnerabilityCVE-2025-47649cve-2025-476490%live
VulnerabilityCVE-2025-48090cve-2025-480900%live
VulnerabilityCVE-2025-49295cve-2025-492950%live
VulnerabilityCVE-2025-49296cve-2025-492960%live
VulnerabilityCVE-2025-49297cve-2025-492970%live
VulnerabilityCVE-2025-52810cve-2025-528100%live
VulnerabilityCVE-2025-52811cve-2025-528110%live
VulnerabilityCVE-2025-59793cve-2025-597930%live
VulnerabilityRARLAB WinRAR Path Traversal Vulnerabilitycve-2025-80880%live
VulnerabilityCVE-2026-20034cve-2026-200340%live
VulnerabilityCVE-2026-25705cve-2026-257050%live
VulnerabilityCVE-2026-42930cve-2026-429300%live
VulnerabilityCVE-2026-45495cve-2026-454950%live
VulnerabilityCVE-2026-7302cve-2026-73020%live
KEVEntryRARLAB WinRAR Path Traversal Vulnerabilitykev-cve-2025-80880%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CWE
Path Traversal: '....//'
CWE
Path Traversal: '...' (Triple Dot)
CWE
Path Traversal: 'dir/../../filename'
CWE
Path Traversal: 'dir\..\..\filename'
CWE
Path Traversal: '....' (Multiple Dot)
CWE
Path Traversal: '/../filedir'
Sourced from MITRE CWE 4.20. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.