84
separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help
to avoid CWE-434. Do not rely exclusively on a filtering mechanism that removes potentially
dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For
example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a
directory separator. Another possible error could occur when the filtering is applied in a way that
still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the
".../...//" string in a sequential fashion, two instances of "../" would be removed from the original
string, but the remaining characters would still form the "../" string.
Effectiveness = High
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2001-0038 Remote attackers can read arbitrary files by specifying the drive letter in the
requested URL.
https://www.cve.org/CVERecord?id=CVE-2001-0038
CVE-2001-0255 FTP server allows remote attackers to list arbitrary directories by using the
"ls" command and including the drive letter name (e.g. C:) in the requested
pathname.
https://www.cve.org/CVERecord?id=CVE-2001-0255
CVE-2001-0687 FTP server allows a remote attacker to retrieve privileged system information
by specifying arbitrary paths.
https://www.cve.org/CVERecord?id=CVE-2001-0687
CVE-2001-0933 FTP server allows remote attackers to list the contents of arbitrary drives via a
ls command that includes the drive letter as an argument.
https://www.cve.org/CVERecord?id=CVE-2001-0933
CVE-2002-0466 Server allows remote attackers to browse arbitrary directories via a full
pathname in the arguments to certain dynamic pages.
https://www.cve.org/CVERecord?id=CVE-2002-0466
CVE-2002-1483 Remote attackers can read arbitrary files via an HTTP request whose
argument is a filename of the form "C:" (Drive letter), "//absolute/path", or ".." .
https://www.cve.org/CVERecord?id=CVE-2002-1483
CVE-2004-2488 FTP server read/access arbitrary files using "C:\" filenames
https://www.cve.org/CVERecord?id=CVE-2004-2488
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 981 SFP Secondary Cluster: Path Traversal 888 2409
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Taxonomy Mappings
CWE Version 4.14
CWE-40: Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
CWE-40: Path Traversal: '\\UNC\share\name\' (Windows UNC Share)