CWE-177: Improper Handling of URL Encoding (Hex Encoding)
The product does not properly handle when all or part of an input has been URL encoded.
A kind of CWE-172 Improper Encoding or Decoding of Data.
From the CWE List. © The MITRE Corporation.
Newest
- labstack echo Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path 7.5 High
- opennextjs opennextjs-cloudflare OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths 7.5 High
- cisco catalyst sd-wan manager Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability 9.8 Critical
- mongodb python driver Connection redirection via percent-encoded delimiter injection in connection string hosts 8.3 High
- axllent mailpit Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) 6.5 Medium
- rapid7 velociraptor Velociraptor Stored XSS in URL column types 8.1 High
- fast-uri fast-uri vulnerable to host confusion via percent-encoded scheme normalization 7.5 High
- apache tomcat Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass 9.1 Critical
- apache gravitino Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints. 9.1 Critical
- @fastify/static, fastify fastify-static +1 more @fastify/static vulnerable to route guard bypass via encoded path separators 5.9 Medium
- hono Hono: Arbitrary file access via serveStatic vulnerability 7.5 High
- fastify fastify-express @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) 8.4 High
- fastify middie, fastify\/middie +1 more Fastify Middie Middleware Path Bypass 8.4 High
- apache linkis Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass 7.5 High
- gitlab Improper Handling of URL Encoding (Hex Encoding) in GitLab 3.1 Low
- qnap qts, quts hero +1 more QTS, QuTS hero 2.3 Low
- ping identity pingaccess Access rules for PingAccess may be circumvented with URL-encoded characters 5.8 Medium
- traefik Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik 4.8 Medium
- ceph, redhat ceph storage +1 more A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit... 6.5 Medium
- keycloak Keycloak vulnerable to path traversal via double URL encoding 9.1 Critical
- haxx curl, netapp clustered data ontap, h300s firmware +12 more +14 more The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host... 7.5 High
-
superstaticnpm Path Traversal in superstatic No score - hackerone serve node module, zeit serve +1 more vercel/serve allows access to restricted files if filename is URL encoded. 5.3 Medium