CWE-42—Path Equivalence: 'filename.' (Trailing Dot)

PUBLISHEDweakness record
released 2006-07-19 · last modified 2025-12-11

Metadata

CWE ID：
CWE-42
摘要：
Variant
结构：
Simple
状态：
Incomplete
发布日期：
2006-07-19
更新日期：
2025-12-11

名称

Path Equivalence: 'filename.' (Trailing Dot)

描述

The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

常见后果

范围：
Access Control
影响：
Bypass Protection Mechanism

相关 CWE

browse all CWEs