Skip to content
OpenAdvisories

Weakness (CWE)

CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream

Variant Incomplete

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

How to prevent it (1 mitigation)

  1. Implementation

    Ensure that the source code correctly parses the filename to read or write to the correct stream.

Source: MITRE CWE-69

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.7
    CVE-2026-52792

    Algernon: Server-side script source disclosure on Windows via NTFS filename

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unaut…

    xyproto algernon github.com/xyproto/algernon Go
  • Medium 5.4
    CVE-2025-3941

    Improper Handling of Windows: DATA Alternate Data Stream

    Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1,…

    Tridium Niagara Enterprise Security Niagara Framework
  • High 8.8
    CVE-2024-43033

    JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution vi…