CWE-27

• CWE ID
• 27

• CWE Name
• Path Traversal: 'dir/../../filename'

• CWE Abstraction
• Variant

• CWE structure
• Simple

• CWE Status
• Draft

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.