Base weakness
Incomplete
CWE-791: Incomplete Filtering of Special Elements
The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
Log in
The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
Last updated
CWE-791 (Incomplete Filtering of Special Elements) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
21 recorded CVEs are caused by CWE-791 (Incomplete Filtering of Special Elements). The highest-severity and most recent are shown first. 7 new CWE-791 CVEs have been recorded so far in 2026 (5 in 2025).
Showing 12 of 21 recorded CWE-791 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-791 vulnerabilitiesWhat can happen when CWE-791 is exploited.
Unexpected State
Affects: Integrity
Typically introduced during these phases of the software lifecycle.
Illustrative examples from MITRE showing how the weakness appears in code.
The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Vulnerable example
my $Username = GetUntrustedInput();Attack input
../../../etc/passwdResulting query
../../etc/passwdResulting query
/home/user/../../etc/passwdCommon questions about CWE-791.
The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
21 recorded CVEs are attributed to CWE-791, including CVE-2025-0324, CVE-2024-47590, CVE-2026-44232.
Exploiting CWE-791 can lead to: Unexpected State.
21 recorded CVEs are caused by CWE-791; none are currently in CISA's KEV catalog of actively exploited flaws.
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Get alerted the moment a new CWE-791 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.