CWE-44: Internal Dot
The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
1 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-24813 — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Recently published
- CVE-2025-24813 — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
More specific weaknesses
- CWE-45 — Multiple Internal Dot