Skip to content
OpenAdvisories

Weakness (CWE)

CWE-641: Improper Restriction of Names for Files and Other Resources

Base Incomplete

The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.

More detail

This may produce resultant weaknesses. For instance, if the names of these resources contain scripting characters, it is possible that a script may get executed in the client's browser if the application ever displays the name of the resource on a dynamically generated web page. Alternately, if the resources are consumed by some application parser, a specially crafted name can exploit some vulnerability internal to the parser, potentially resulting in execution of arbitrary code on the server machine. The problems will vary based on the context of usage of such malformed resource names and whether vulnerabilities are present in or assumptions are made by the targeted technology that would make code execution possible.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Do not allow users to control names of resources used on the server side.

  2. Architecture and Design

    Perform allowlist input validation at entry points and also before consuming the resources. Reject bad file names rather than trying to cleanse them.

  3. Architecture and Design

    Make sure that technologies consuming the resources are not vulnerable (e.g. buffer overflow, format string, etc.) in a way that would allow code execution if the name of the resource is malformed.

Source: MITRE CWE-641

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-20282

    Cisco Identity Services Engine Authenticated Write Vulnerability

    A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit …

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.2
    CVE-2019-25623

    Luminance Studio 2.17 Denial of Service via Malformed Input

    Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can create a text file with arbitrary character sequences and trigger …

    Pixarra Luminance Studio
  • Medium 6.5
    CVE-2024-47260

    51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient…

    Axis Communications AB AXIS OS
  • Medium 5.3
    CVE-2024-45312

    Arbitrary language parameter can passed to `aspell` executable via spelling requests in overleaf

    Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vulnerability that allows an arbitrary language parameter in client spelling requests to be passed to …

    overleaf overleaf
  • Medium 6.7
    CVE-2024-30063

    Windows Distributed File System (DFS) Remote Code Execution Vulnerability

    Windows Distributed File System (DFS) Remote Code Execution Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Medium 6.5
    CVE-2022-23536

    Alertmanager can expose local files content via specially crafted config

    Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertm…

    cortexproject cortex github.com/cortexproject/cortex Go