Weakness (CWE)
CWE-641: Improper Restriction of Names for Files and Other Resources
The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
More detail
This may produce resultant weaknesses. For instance, if the names of these resources contain scripting characters, it is possible that a script may get executed in the client's browser if the application ever displays the name of the resource on a dynamically generated web page. Alternately, if the resources are consumed by some application parser, a specially crafted name can exploit some vulnerability internal to the parser, potentially resulting in execution of arbitrary code on the server machine. The problems will vary based on the context of usage of such malformed resource names and whether vulnerabilities are present in or assumptions are made by the targeted technology that would make code execution possible.
How to prevent it (3 mitigations)
-
Architecture and Design
Do not allow users to control names of resources used on the server side.
-
Architecture and Design
Perform allowlist input validation at entry points and also before consuming the resources. Reject bad file names rather than trying to cleanse them.
-
Architecture and Design
Make sure that technologies consuming the resources are not vulnerable (e.g. buffer overflow, format string, etc.) in a way that would allow code execution if the name of the resource is malformed.
Source: MITRE CWE-641
13 results · Clear filters · Feed
-
High 7.8
Python Elevation of Privilege Vulnerability
Improper privilege management in Python allows an authorized attacker to elevate privileges locally.
-
High 7.5
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or…
-
High 7.8
GitHub Copilot Remote Code Execution Vulnerability
Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.
-
High 8.3
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for…
-
High 8.8
Code execution vulnerability in SWIG code generation in cmd/go
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
-
High 8.8CVE-2026-25177 Public exploit
Active Directory Domain Services Elevation of Privilege Vulnerability
Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Office OneNote Remote Code Execution Vulnerability
Microsoft Office OneNote Remote Code Execution Vulnerability
-
High 7.8
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Remote Code Execution Vulnerability
-
High 7.2
Improper Restriction of Names for Files and Other Resources in lirantal/daloradius
Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
-
High 8.8
File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the fi…
-
High 8.8
Arbitrary command execution on Windows in qutebrowser
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserur…