Skip to content
OpenAdvisories

Weakness (CWE)

CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream

Variant Incomplete

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

How to prevent it (1 mitigation)

  1. Implementation

    Ensure that the source code correctly parses the filename to read or write to the correct stream.

Source: MITRE CWE-69

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-52792

    Algernon: Server-side script source disclosure on Windows via NTFS filename

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unaut…

    xyproto algernon github.com/xyproto/algernon Go
  • High 8.8
    CVE-2024-43033

    JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution vi…