CWE-34

Overview
  • CWE ID
  • 34
  • CWE Name
  • Path Traversal: '....//'
  • CWE Abstraction
  • Variant
  • CWE structure
  • Simple
  • CWE Status
  • Incomplete
Description
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....//' (doubled dot dot slash) sequences that can resolve to a location that is outside of that directory.
Extended Description
Related CWEs
CWE ID View ID Nature Ordinal
23 1000 ChildOf Primary