Skip to content
OpenAdvisories

Weakness (CWE)

CWE-44: Path Equivalence: 'file.name' (Internal Dot)

Variant Incomplete

The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Source: MITRE CWE-44

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 10.0
    CVE-2025-24813 Exploited Public exploit EPSS 100%

    Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

    Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
    KEV Apr 1, 2025