CWE-67: Improper Handling of Windows Device Names
The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
A kind of CWE-66 Improper Handling of File Names that Identify Virtual Resources.
From the CWE List. © The MITRE Corporation.
Newest
- pallets werkzeug Werkzeug safe_join() allows Windows special device names 6.3 Medium
- php PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS 6.9 Medium
- pallets werkzeug Werkzeug safe_join() allows Windows special device names 6.3 Medium
- pallets werkzeug Werkzeug safe_join() allows Windows special device names with compound extensions 6.3 Medium
- pallets werkzeug Werkzeug safe_join() allows Windows special device names 6.3 Medium
- bytecodealliance wasmtime Wasmtime doesn't fully sandbox all the Windows device filenames 2.3 Low
- byron gitoxide gix refs and paths with reserved Windows device names access the devices 5.4 Medium