Weakness (CWE)
CWE-641: Improper Restriction of Names for Files and Other Resources
The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
More detail
This may produce resultant weaknesses. For instance, if the names of these resources contain scripting characters, it is possible that a script may get executed in the client's browser if the application ever displays the name of the resource on a dynamically generated web page. Alternately, if the resources are consumed by some application parser, a specially crafted name can exploit some vulnerability internal to the parser, potentially resulting in execution of arbitrary code on the server machine. The problems will vary based on the context of usage of such malformed resource names and whether vulnerabilities are present in or assumptions are made by the targeted technology that would make code execution possible.
How to prevent it (3 mitigations)
-
Architecture and Design
Do not allow users to control names of resources used on the server side.
-
Architecture and Design
Perform allowlist input validation at entry points and also before consuming the resources. Reject bad file names rather than trying to cleanse them.
-
Architecture and Design
Make sure that technologies consuming the resources are not vulnerable (e.g. buffer overflow, format string, etc.) in a way that would allow code execution if the name of the resource is malformed.
Source: MITRE CWE-641
20 results · Feed
-
High 7.8
Python Elevation of Privilege Vulnerability
Improper privilege management in Python allows an authorized attacker to elevate privileges locally.
-
Medium 4.9
Cisco Identity Services Engine Authenticated Write Vulnerability
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit …
-
High 7.5
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or…
-
High 7.8
GitHub Copilot Remote Code Execution Vulnerability
Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.
-
High 8.3
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for…
-
High 8.8
Code execution vulnerability in SWIG code generation in cmd/go
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
-
Medium 6.2
Luminance Studio 2.17 Denial of Service via Malformed Input
Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can create a text file with arbitrary character sequences and trigger …
-
High 8.8CVE-2026-25177 Public exploit
Active Directory Domain Services Elevation of Privilege Vulnerability
Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
-
Medium 6.5
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient…
-
High 7.8
Microsoft Office OneNote Remote Code Execution Vulnerability
Microsoft Office OneNote Remote Code Execution Vulnerability
-
High 7.8
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Remote Code Execution Vulnerability
-
Medium 5.3
Arbitrary language parameter can passed to `aspell` executable via spelling requests in overleaf
Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vulnerability that allows an arbitrary language parameter in client spelling requests to be passed to …
-
Medium 6.7
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
-
High 7.2
Improper Restriction of Names for Files and Other Resources in lirantal/daloradius
Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
-
Medium 6.5
Alertmanager can expose local files content via specially crafted config
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertm…
-
High 8.8
File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the fi…
-
High 8.8
Arbitrary command execution on Windows in qutebrowser
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserur…
-
Critical 9.8
Object injection in PHPMailer/PHPMailer
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always conside…