CWE-790: Improper Filtering of Special Elements
The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
Last updated
Overview
CWE-790 (Improper Filtering of Special Elements) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
13 recorded CVEs are caused by CWE-790 (Improper Filtering of Special Elements). The highest-severity and most recent are shown first. 4 new CWE-790 CVEs have been recorded so far in 2026 (1 in 2025).
- CVE-2023-22578Critical · CVSS 10.0 · EPSS 55th2023-02-16
- CVE-2021-43802Critical · CVSS 9.9 · EPSS 79th2021-12-09
- CVE-2023-45239Critical · CVSS 9.8 · EPSS 77th2023-10-06
- CVE-2024-31616High · CVSS 8.8 · EPSS 55th2024-04-23
- CVE-2026-11331
Potential wildcard CNAME RPZ policy bypass
High · CVSS 7.5 · EPSS 36th2026-07-22 - CVE-2026-2328
Backend Access Due to Insufficient Input Validation
High · CVSS 7.5 · EPSS 23th2026-03-30 - CVE-2026-9658
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths
High · CVSS 7.3 · EPSS 13th2026-05-28 - CVE-2025-27260
Ericsson Indoor Connect 8855 - Improper Filtering of Special Elements Vulnerability
High · CVSS 7.2 · EPSS 12th2026-03-25 - CVE-2024-47984Medium · CVSS 6.5 · EPSS 38th2024-12-13
- CVE-2025-0431
Enterprise Protection Backslash URL Rewrite Bypass
Medium · CVSS 5.8 · EPSS 33th2025-03-19 - CVE-2024-6540Medium · CVSS 5.7 · EPSS 31th2024-07-15
- CVE-2024-43443
Stored XSS in process management
Medium · CVSS 4.9 · EPSS 28th2024-08-26
Showing 12 of 13 recorded CWE-790 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-790 vulnerabilitiesCommon consequences
What can happen when CWE-790 is exploited.
Unexpected State
Affects: Integrity
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Vulnerable example
my $Username = GetUntrustedInput();Attack input
../../../etc/passwdResulting query
../../etc/passwdResulting query
/home/user/../../etc/passwdFrequently asked questions
Common questions about CWE-790.
- What is CWE-790?
- The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
- What CVEs are caused by CWE-790?
- 13 recorded CVEs are attributed to CWE-790, including CVE-2023-22578, CVE-2021-43802, CVE-2023-45239.
- What are the consequences of CWE-790?
- Exploiting CWE-790 can lead to: Unexpected State.
- Is CWE-790 actively exploited?
- 13 recorded CVEs are caused by CWE-790; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-790) (opens in a new tab)
- CWE-790 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-790
Get alerted the moment a new CWE-790 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.