CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
The product validates input before it is canonicalized.
A kind of CWE-179 Incorrect Behavior Order: Early Validation.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains junie github action In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via... 5.4 Medium
-
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect No score - vitejs vite Vite: `server.fs.deny` bypassed with queries 6.9 Medium
- baserproject basercms baserCMS: Encoded path traversal bypass in the theme file API 7.2 High
- zimbra collaboration suite Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization 4.3 Medium
- fast-uri fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding 6.1 Medium
- projectsend ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete 6.0 Medium
- opennextjs opennextjs-cloudflare OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths 7.5 High
- n8n-io n8n n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook 7.0 High
- moby buildkit Crafted Git build source can bypass certain policy validation 6.0 Medium
- peazip PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a... 7.1 High
- apache wss4j Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce 4.8 Medium
- jpadilla pyjwt PyJWT: Non-canonical signature segments enable raw-token revocation bypass 4.8 Medium
- stoatchat stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization 5.3 Medium
- openclaw OpenClaw before 2026.8.1 Authentication Bypass via File URL 6.8 Medium
- input-leap input leap Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used... 5.3 Medium
- allauth django-allauth django-allauth before 65.19.4 does not have the expected limits on failed login attempts because,... 3.7 Low
-
lemonldap-ngDebian Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restric… 6.5 Medium - cosmicstack-labs mercury-agent cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize 5.3 Medium
- sep sesam SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is... 3.5 Low
- ash-project ash Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass 2.1 Low
- mirage cohttp The cohttp package before 6.3.0 for OCaml allows directory traversal. 8.7 High
- maalfer pentestify CSS sanitizer bypass in Pentestify report themes allows forced outbound requests 5.1 Medium
- mintplex-labs anything-llm AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization 5.9 Medium
- guzzle Guzzle: Noncanonical host can bypass host-based checks 7.2 High
- guzzle Guzzle: Noncanonical cookie domain keeps subdomain scope 6.5 Medium
- copier-org copier Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass) 7.5 High
- eclipse foundation basyx go components CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components 9.8 Critical
- @auth core, nextauthjs next-auth +1 more NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass 9.1 Critical
- @fastify/static, fastify fastify-static +1 more @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths 5.3 Medium
- jupyterlab jupyterlab: PyPI extension blocklist package-name canonicalization bypass 6.1 Medium
- owasp modsecurity ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass 8.6 High
- kestra Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard) 7.7 High
- fatpipe warp Warp: Env-var prefixes can lead to denylisted command autoexecution 8.6 High
- jupyter enterprise gateway Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed 9.8 Critical
- @fedify fedify Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring 7.0 High
- go-git go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git 7.0 High
- hono Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses 6.3 Medium
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 more Vite has a `server.fs.deny` bypass with queries 8.2 High
- rack Rack: Rack::Static header_rules bypass via URL-encoded paths 5.3 Medium
- varnish-software varnish cache, varnish enterprise, vinyl-cache vinyl cache +2 more Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url... 5.4 Medium
- openclaw OpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation 6.0 Medium
- caddyserver caddy Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport 8.9 High
- php frankenphp FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files 8.9 High
- nvidia dgx spark, dgx os +1 more NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause... 5.7 Medium
- vitejs vite vite allows server.fs.deny bypass via backslash on Windows 6.0 Medium
- ivanti landesk management suite A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9.... 5.8 Medium
- zip-rs zip2 zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write 7.3 High
- librasean ip-utils The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such... 2.9 Low
-
github.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 more Traefik has unexpected behavior with IPv4-mapped IPv6 addresses No score - Show olderLoading…