CWE-35
Overview
- CWE ID
- 35
- CWE Name
- Path Traversal: '.../...//'
- CWE Abstraction
- Variant
- CWE structure
- Simple
- CWE Status
- Incomplete
Description
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
Extended Description
Related CWEs
| CWE ID | View ID | Nature | Ordinal |
|---|---|---|---|
| 23 | 1000 | ChildOf | Primary |