CWE-41: Improper Resolution of Path Equivalence
The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- @clerk nuxt, @nuxt nitro-server +1 more Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes 6.5 Medium
- syncplify, inc. syncplify server! Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing 8.6 High
- fast-uri fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references 3.7 Low
- fast-uri fast-uri vulnerable to improper path equivalence in relative reference normalization 3.7 Low
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 more Windows SmartScreen Security Feature Bypass Vulnerability 8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more WebDAV Elevation of Privilege Vulnerability 8.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +11 more +13 more Windows Backup Engine Elevation of Privilege Vulnerability 7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability 8.8 High
- microsoft visual studio code Visual Studio Code Security Feature Bypass Vulnerability 7.7 High
-
libdancer2-perlDebian,perl-Dancer2openSUSE +1 more Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler 5.3 Medium - perforce akana Unauthenticated Remote Code Execution in Akana API Platform 10.0 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows URL Moniker Security Feature Bypass Vulnerability 4.3 Medium
- filebrowser filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization 7.6 High
- goshs-labs goshs goshs has ACL Bypass & Path Traversal 5.3 Medium
- quarkus, red hat cryostat 4 on rhel 9, openshift serverless +15 more +17 more Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities 7.5 High
- bitbonsai mcpvault MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence 8.4 High
- deno Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) 7.3 High
- fission Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape 3.6 Low
- gitlab Improper Resolution of Path Equivalence in GitLab 8.0 High
- anthropic claude sdk for typescript, anthropics anthropic-sdk-typescript +1 more Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories 6.3 Medium
- openclaw OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders 6.9 Medium
- openclaw OpenClaw - Approval Bypass via Environment Variable Normalization 6.9 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 more MapUrlToZone Security Feature Bypass Vulnerability 7.5 High
- better-auth Better Auth before 1.4.5 Path Normalization Bypass via rou3 8.8 High
- huawei harmonyos Denial of service (DoS) vulnerability in the office service. Successful exploitation of this... 3.3 Low
- apple macos A parsing issue in the handling of directory paths was addressed with improved path validation.... 7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 more MapUrlToZone Security Feature Bypass Vulnerability 4.3 Medium
- gradio-app gradio-app/gradio Path Traversal in gradio-app/gradio 5.3 Medium
- lunary, lunary-ai lunary-ai/lunary +1 more Improper Path Equivalence Resolution in lunary-ai/lunary 7.3 High
- corydolphin corydolphin/flask-cors, flask-cors project flask-cors +1 more Improper Regex Path Matching in corydolphin/flask-cors 4.3 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 more PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI 6.8 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 more MapUrlToZone Security Feature Bypass Vulnerability 4.3 Medium
- fortinet fortiportal An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7... 8.1 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 more MapUrlToZone Security Feature Bypass Vulnerability 4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 more MapUrlToZone Security Feature Bypass Vulnerability 4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 more MapUrlToZone Security Feature Bypass Vulnerability 4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 more MapUrlToZone Security Feature Bypass Vulnerability 4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 more MapUrlToZone Security Feature Bypass Vulnerability 4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 more Windows HTML Platforms Security Feature Bypass Vulnerability 4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 more MapUrlToZone Security Feature Bypass Vulnerability 4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +33 more +35 more Windows Security Zone Mapping Security Feature Bypass Vulnerability 7.8 High
- byron gitoxide gix-path improperly resolves configuration path reported by Git 6.0 Medium
- microsoft windows server 2008 service pack 2, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +12 more +14 more Windows Deployment Services Information Disclosure Vulnerability 6.5 Medium
- ibm ds8900f, ds8900f firmware +1 more IBM DS8900F file manipulation 6.5 Medium
- microsoft windows 11 version 22h2, windows 11 version 22h3, windows 11 version 23h2 +2 more +4 more Windows Compressed Folder Remote Code Execution Vulnerability 7.8 High
- microweber whmcs, microweber-dev microweber-dev/whmcs plugin +1 more Improper Resolution of Path Equivalence in microweber-dev/whmcs_plugin 7.4 High