CVE-2026-44788: Path Traversal Case Sensitive Starts With
When performing path boundary checking, verifying paths via a case-sensitive `StartsWith` (e.g., `StringComparison.Ordinal`) is unsafe on case-insensitive file systems like Windows. Attackers can bypass the restriction by mixing case or leveraging symlink resolutions. Use a platform-aware string comparison check (e.g., `StringComparison.OrdinalIgnoreCase`).
Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0
C#β
C#βgreprules fetch cve-2026-44788-path-traversal-case-sensitive-starts-with --engine opengrepDescription
When performing path boundary checking, verifying paths via a case-sensitive `StartsWith` (e.g., `StringComparison.Ordinal`) is unsafe on case-insensitive file systems like Windows. Attackers can bypass the restriction by mixing case or leveraging symlink resolutions. Use a platform-aware string comparison check (e.g., `StringComparison.OrdinalIgnoreCase`).
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0