CWE-41: Improper Resolution of Path Equivalence
The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.
29 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2025-24470 — An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.
- CVE-2026-5816 — Improper Resolution of Path Equivalence in GitLab
- CVE-2026-72835 — filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
- CVE-2026-34451 — Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories
- CVE-2026-49401 — Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- CVE-2025-0115 — PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI
- CVE-2026-66064 — goshs has ACL Bypass & Path Traversal
- CVE-2025-58290 — Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect av
- CVE-2026-50568 — Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
Recently published
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2026-72835 — filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
- CVE-2026-66064 — goshs has ACL Bypass & Path Traversal
- CVE-2026-49401 — Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- CVE-2026-50568 — Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
- CVE-2026-5816 — Improper Resolution of Path Equivalence in GitLab
- CVE-2026-34451 — Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories
- CVE-2025-58290 — Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect av
- CVE-2025-0115 — PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI
- CVE-2025-24470 — An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.
More specific weaknesses
- CWE-42 — Trailing Dot
- CWE-44 — Internal Dot
- CWE-46 — Trailing Space
- CWE-47 — Leading Space
- CWE-48 — Internal Whitespace
- CWE-49 — Trailing Slash
- CWE-50 — Path Equivalence: '//multiple/leading/slash'
- CWE-51 — Path Equivalence: '/multiple//internal/slash'
- CWE-52 — Path Equivalence: '/multiple/trailing/slash//'
- CWE-53 — Path Equivalence: '\multiple\\internal\backslash'
- CWE-54 — Trailing Backslash
- CWE-55 — Single Dot Directory
- CWE-56 — Wildcard
- CWE-57 — Path Equivalence: 'fakedir/../realdir/filename'
- CWE-58 — Path Equivalence: Windows 8.3 Filename