Rule Explorer

A URL path is passed to path.basename() BEFORE decodeURIComponent(), so percent-encoded separators (%2f, %5c) and dot segments (%2e%2e) survive basename() and only decode into '/', '\' or '../' afterwards. The decoded file name can therefore contain traversal segments, and joining it onto a base directory with path.join() resolves the destination outside tha

TSNode.jsCVE-2026-116073CWE-22CWE-23

A client-controlled file name flows into a filesystem path built with filepath.Join / string concatenation and reaches a filesystem operation without a containment check. filepath.Join only lexically cleans "." and ".." elements, so a name containing "../" resolves outside the intended base directory, enabling arbitrary file read/write/delete; interpolating

GoCVE-2026-116067CWE-22CWE-23CWE-73

A user-controlled filename reaches a write-mode file operation through a path built with File.join(base_dir, name) without being reduced with File.basename and without verifying that the final expanded path stays inside the base directory. A name containing "../" (or an absolute path) escapes the intended directory, giving an attacker an arbitrary file write

RubyRailsCVE-2026-116009CWE-22CWE-23CWE-434

Unconfined path construction before a file read: a dynamic path segment $COMP is joined onto a base directory with os.path.join() and the result is opened without os.path.realpath() canonicalization and without a containment check. os.path.join() silently discards the base directory when $COMP is absolute, and os.path.normpath() only collapses ".." segments

PythonCVE-2026-115354CWE-22CWE-23CWE-36

Path traversal (CWE-22): a file path is built with os.path.join($BASE, $P) and passed to open() without proving the resolved target stays inside $BASE. os.path.join silently discards $BASE when $P is absolute, and os.path.normpath only collapses "../" lexically, so an attacker-controlled $P can read any file readable by the process. Reject absolute arguments

PythonCVE-2026-115353CWE-22CWE-23CWE-73

A runtime path component is joined onto the configuration-defined served root with filepath.Join inside an HTTP handler that renames files with os.Rename. filepath.Join and filepath.Clean only lexically normalize a path: ".." segments, absolute paths, backslash and percent-encoded separators all survive, so a request-controlled name or directory joined onto

GoCVE-2026-114375CWE-22CWE-23

A filesystem destination is built with `$BASE.join($SCRIPT.name)` and the result is not checked to stay inside `$BASE`. If `$SCRIPT.name` originates from parsed external data (e.g. an archive/manifest entry name such as a wheel entry-point key), a value containing `..` or an absolute path makes `Path::join` escape `$BASE` entirely, turning a write into that

RustCVE-2026-114109GHSA-4GG8-GXPX-9RPHCWE-22CWE-23

Archive member name ($MEMBER_EXPR) is joined onto base path $BASE and the result is used as an extraction destination without a containment check. Member names containing "../" sequences or an absolute path resolve outside the destination directory, so an attacker-supplied archive can write arbitrary files (Zip Slip, CWE-22). Resolve the joined path and veri

PythonCVE-2026-113613CWE-22CWE-23

A caller-controlled model-artifact path reaches an external classifier/JVM command line as the value of a read/write option ("-l" read target, "-d" write target) without being bounded to the containment data roots. An attacker who controls the model path can make the external process write an arbitrary file via "-d" (e.g. ../../../etc/cron.d/evil or ~/.ssh/a

PythonCVE-2026-109956CWE-20CWE-22CWE-23

A filesystem path handed to a file-deletion routine is built by string concatenation with an unvalidated value. Path-traversal sequences such as "../" (or backslashes or NUL bytes) in that value escape the intended media directory and let an attacker delete arbitrary files (other users' content, application configuration and cache files), causing content los

PHPCVE-2026-108902CWE-22CWE-23

A caller-supplied file name (and/or owner/folder id) is joined directly into a filesystem path and used for a file operation without path-containment validation. A URL-decoded name containing "/" or ".." escapes the storage directory boundary (data_dir/<id>/) and lets an authenticated caller read, overwrite, delete or stat files outside the intended folder,

PythonCVE-2026-105699CWE-22CWE-23

A single non-recursive str_replace() pass is used to strip '../' or '..\' from a path or archive entry name. One pass is not idempotent: crafted names such as "....//" lose their inner "../" and the residual ".." + "/" re-splice into a live "../", so the "sanitized" path still escapes the extraction directory (Zip Slip) and enables arbitrary file overwrite,

PHPCVE-2026-104081CWE-22CWE-23CWE-79

A path or URI normalized with a drive-aware path module (os.path, which is ntpath on Windows, or ntpath directly) flows into a leading-dot-dot containment check. ntpath.normpath() splits off a drive designator and absorbs the following ".." segments into the drive root (e.g. "C:/../../secret.txt" normalizes to "C:\secret.txt"), so the traversal guard is bypa

PythonCVE-2026-102991CWE-22CWE-23

A plugin-manifest validator inspects a manifest-supplied path field (e.g. `wasm_path`) but never component-validates its VALUE before that value is combined with trusted base directories via `Path::join` during plugin install/discovery (CVE-2026-101885). `Path::join` lets an absolute component (`/home/u/.bashrc`) replace the trusted base entirely and passes

RustCVE-2026-101885CWE-22CWE-23CWE-36

A value read from a message/exchange header flows into a process command argument list without being normalized or confined to a base directory. An attacker who can set the header can make the external tool write (or read) outside the intended directory via an absolute path or ".." segments. Canonicalize the path (Paths.get($p).normalize()) and, when a base

JavaCVE-2026-95629CWE-22CWE-23CWE-36

Archive entry name flows into a filesystem write path without being cleaned and rejected when it still starts with ".." or is absolute. filepath.Join only cleans the result; it does not confine it to the destination directory, so a crafted entry name such as ../../x or /etc/x escapes the extraction directory (Zip Slip) and lets an attacker create directories

GoCVE-2026-93992GHSA-X8RX-77VV-C6PQCWE-22CWE-23

A path containment check was performed using `startsWith` on a resolved `Path` that has not been normalized. In Java, `parentPath.resolve(childPath)` retains `parentPath`'s components as its prefix even if `childPath` contains traversal sequences (`..`). Calling `startsWith(parentPath)` on an unnormalized resolved path will evaluate to true, failing to preve

JavaCVE-2026-87976CWE-22CWE-23

Constructing a target file path by joining a base directory with the result of `filepath.FromSlash` without verifying path containment allows directory traversal via '../' sequences (CVE-2026-86775). Validate that the target path remains within the intended root using `filepath.Rel` or `filepath.Localize`.

GoCVE-2026-86775CWE-22CWE-23

HTTP request input flows into a filesystem path without first being validated as a single path segment. A value containing "..", "/" or "\" escapes the base directory passed to filepath.Join/path.Join, so an unauthenticated attacker can delete, create, overwrite or read files anywhere the server process can reach. Validate the value as one path segment (reje

GoCVE-2026-86542CWE-22CWE-23

A destructive, root-privileged filesystem operation (os.Remove, os.Rename, recursive deleteSubvolume, or setReceivedUUID) targets a precomputed subvolume destination from the copyOps loop ($OP.dest) or a destination built inline by joining a privileged volume mount path with an externally decoded subvolume path. Those destinations originate from attacker-inf

GoCVE-2026-85526CWE-22CWE-23CWE-59

A destination path propagated from an externally supplied metadata header ($OP.$DESTFIELD, the copy-op target the restore loop received for a subvolume listed in the migration/optimized-backup header decoded with json.Unmarshal / yaml Decode) is used as the DESTINATION of a destructive filesystem operation (os.Remove / os.Rename, or the btrfs-specific delete

GoCVE-2026-85185CWE-20CWE-22CWE-23

Unvalidated tar entry name written to the filesystem. The name returned by tar.Reader.Next() is fully controlled by the archive; using it (directly, or via filepath.Join which only cleans and never contains) to create directories or files lets an entry named '../...' or '/abs/path' escape the extraction directory (Zip-Slip/Tar-Slip, CWE-22). Reject empty and

GoCVE-2026-77156CWE-22CWE-23

An attacker-influenced identifier ($IDENT) read off a data object ($OBJ: a plugin/request/tenant context, config or mapping) flows into filesystem path construction or into a startswith()/endswith() access-control prefix without validation. A value containing "/", "\", a NUL byte or ".." makes os.path.realpath()/os.path.expanduser() resolve the boundary dire

PythonCVE-2026-74884GHSA-8JPJ-W975-RWV5CWE-22CWE-23

$FUNC() validates a name with a character whitelist that explicitly allows '.' but never rejects a leading '.', so a name made entirely of dots (e.g. "..") passes validation. Such a name is later used as a filesystem path component: a whole name equal to ".." resolves to the parent directory, so paths built as "<base>/<name>" escape the intended directory an

CCVE-2026-74038CWE-20CWE-23