CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- cisco iot field network director, iot field network director (iot-fnd) +1 moreCisco IoT Field Network Director File Overwrite Vulnerability4.9 Medium
- chocolatey boxstarterPrivilege Escalation in Boxstarter8.0 High
- f2fs-tools project f2fs-toolsAn exploitable code execution vulnerability exists in the multiple devices functionality of F2fs...8.2 High
- kubernetes ingress-nginxKubernetes ingress-nginx Compromise of auth via subset/superset namespace names5.9 Medium
- octobercms octoberArbitrary File Deletion vulnerability in OctoberCMS6.2 Medium
- octobercms octoberUpload whitelisted files to any directory in OctoberCMS3.4 Low
- opensuse factory, leap 15.1, osc +4 more +6 moreosc: stores downloaded (supposed) RPM in network-controlled filesystem paths7.5 High
- palo alto networks pan-osPAN-OS: Panorama SD WAN arbitrary file creation7.2 High
- palo alto networks pan-osPAN-OS: OS command injection or arbitrary file deletion vulnerability7.2 High
- palo alto networks pan-osPAN-OS: Authenticated administrator can delete arbitrary system file6.5 Medium
- juniper junos, junos os +1 moreOut of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services8.8 High
- paloaltonetworks secdoSecdo: Privilege escalation via hardcoded script path7.8 High
- naver cloud explorerNaver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the...9.8 Critical
- red hat ansible, redhat ansible engine, fedoraproject fedora +6 more +8 moreExternally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible7.3 High
- html-pdf project html-pdfArbitrary File Read in html-pdf7.5 High
- elastic kibana, redhat openshift container platform +1 moreKibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console...9.8 Critical
- advantech webaccessAdvantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external...7.5 High
- advantech webaccess, webaccess dashboard, webaccess scada +1 more +3 moreIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior,...7.5 High
- ecava integraxor, integraxor scada server +1 moreEcava IntegraXor SCADA Server External Control of File Name or Path8.3