CVE-2026-39859: Conditional Path Containment Bypass
A directory containment verification is conditionally bypassed based on an inequality condition. This logic error can allow path traversal or local file inclusion (LFI) because outer path boundaries are discarded for specific cases. Ensure containment invariants are enforced unconditionally on all file lookup operations.
greprules fetch cve-2026-39859-conditional-path-containment-bypass --engine opengrepDescription
A directory containment verification is conditionally bypassed based on an inequality condition. This logic error can allow path traversal or local file inclusion (LFI) because outer path boundaries are discarded for specific cases. Ensure containment invariants are enforced unconditionally on all file lookup operations.
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.