Variant weakness
Incomplete
CWE-42: Path Equivalence: 'filename.' (Trailing Dot)
The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Last updated
0
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
CWE-42 (Path Equivalence: 'filename.' (Trailing Dot)) is a variant-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Common consequences
What can happen when CWE-42 is exploited.
Bypass Protection Mechanism
Affects: Access Control
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Implementation
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2000-1114 — Source code disclosure using trailing dot
- CVE-2002-1986 — Source code disclosure using trailing dot
- CVE-2004-2213 — Source code disclosure using trailing dot