80
separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help
to avoid CWE-434. Do not rely exclusively on a filtering mechanism that removes potentially
dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For
example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a
directory separator. Another possible error could occur when the filtering is applied in a way that
still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the
".../...//" string in a sequential fashion, two instances of "../" would be removed from the original
string, but the remaining characters would still form the "../" string.
Effectiveness = High
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2002-1345 Multiple FTP clients write arbitrary files via absolute paths in server responses
https://www.cve.org/CVERecord?id=CVE-2002-1345
CVE-2001-1269 ZIP file extractor allows full path
https://www.cve.org/CVERecord?id=CVE-2001-1269
CVE-2002-1818 Path traversal using absolute pathname
https://www.cve.org/CVERecord?id=CVE-2002-1818
CVE-2002-1913 Path traversal using absolute pathname
https://www.cve.org/CVERecord?id=CVE-2002-1913
CVE-2005-2147 Path traversal using absolute pathname
https://www.cve.org/CVERecord?id=CVE-2005-2147
CVE-2000-0614 Arbitrary files may be overwritten via compressed attachments that specify
absolute path names for the decompressed output.
https://www.cve.org/CVERecord?id=CVE-2000-0614
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 981 SFP Secondary Cluster: Path Traversal 888 2409
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER /absolute/pathname/here
CERT C Secure Coding FIO05-C Identify files using multiple file attributes
Software Fault Patterns SFP16 Path Traversal
CWE-38: Path Traversal: '\absolute\pathname\here'
CWE Version 4.14
CWE-38: Path Traversal: '\absolute\pathname\here'
CWE-38: Path Traversal: '\absolute\pathname\here'