External Control of File Name or Path
CWE-73
The product allows user input to control or influence paths or file names that are used in filesystem operations.
We track 436 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 8.3. 6 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to inbox.txt and ID 2 could map to profile.txt. Features such as the ESAPI AccessReferenceMap provide this capability.
- Architecture and Design Operation: Run your code in a jail or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Implementation: Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes.. sequences and symbolic links (CWE-23, CWE-59).
- Installation Operation: Use OS-level permissions and run as a low-privileged user to limit the scope of any successful attack.
Latest External Control of File Name or Path vulnerabilities
- 7.1 High severity
backup_exec: External Control of File Name or Path
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files.
- 7.8 High severity
FortiClientMac: External Control of File Name or Path
An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp be
- 7.5 High severity
voila: External Control of File Name or Path
Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded
- 9.8 Critical severity
House Rental Management System: External Control of File Name or Path
A vulnerability was found in Campcodes House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The at
- 9.8 Critical severity
php-svg-lib: Externally Controlled Reference to a Resource in Another Sphere
php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external reference
- 9.8 Critical severity
CMS: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument c_cmodel leads to file inclusion. The attack can be launched
- 7.5 High severity
AVideo: External Control of File Name or Path
An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.
- 9.8 Critical severity
AVideo: External Control of File Name or Path
A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send a series of HTTP requests to trigge
- 8.8 High severity
Clinic Queuing System: External Control of File Name or Path
A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component GET Parameter Handler. The manipulation of the argument page leads to file
- 8.8 High severity
Simple Student Attendance System: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusi
- 7.8 High severity
GX Works3: Externally Controlled Reference to a Resource in Another Sphere
Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted pro
- 8.8 High severity
Foxit Reader: Externally Controlled Reference to a Resource in Another Sphere
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbi
- 8.8 High severity
Foxit Reader: Externally Controlled Reference to a Resource in Another Sphere
A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files, which can lead to remote code execution. An attacker needs to trick the user into opening the malici
- 8.8 High severity
Foxit Reader: Externally Controlled Reference to a Resource in Another Sphere
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which c
- 7.1 High severity
SystemPlatform: Externally Controlled Reference to a Resource in Another Sphere
This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.
- 7.5 High severity
Unity: External Control of File Name or Path
Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting arbitrary files through a request to the server.
- 8.8 High severity
FortiAP-U: External Control of File Name or Path
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbi
- 9.8 Critical severity
Media Library Assistant: External Control of File Name or Path
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from t
- 8.1 High severity
OAS Platform: Externally Controlled Reference to a Resource in Another Sphere
A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequen
- 9.8 Critical severity
Inventory Management System: External Control of File Name or Path
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the a
- 9.8 Critical severity
Resort Reservation System: External Control of File Name or Path
A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The at
- 9.8 Critical severity
Boss Mini: External Control of File Name or Path
A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack re
- 7.1 High severity
Zoom VDI Windows Meeting Client: External Control of File Name or Path
Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
- 9.8 Critical severity
Student Study Center Desk Management System: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file i
- 9.8 Critical severity
FortiNAC: Exposure of Resource to Wrong Sphere
A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute u
- 7.5 High severity
Automation License Manager V5: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with u
- 7.8 High severity
vGPU software (guest driver) - Windows, NVIDIA…: Externally Controlled Reference to a Resource in Another Sphere
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or other files that are critical to the application, which may lead to code execution, denial of service
- 8.8 High severity
Thunderbird: External Control of File Name or Path
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>*This bug only affects Firefox for Windows. Oth
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the accoun
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the accoun
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the accoun
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to t
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to t
- 8.8 High severity
Download Manager: Externally Controlled Reference to a Resource in Another Sphere
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that
- 8.6 High severity
Piano-LED-Visualizer: Exposure of Resource to Wrong Sphere
Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os
- 9.8 Critical severity
Juniper Junos OS Path Traversal Exploited
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI)