CWE-41 Improper Resolution of Path Equivalence
Description
The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-41 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-8xpq-cjcf-3wh9 | CVE-2026-49401 | HIGH | - |
Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) |
2026-07-31 |
| GHSA-qcxp-gm7m-4j5v | CVE-2026-50559 | HIGH |
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities |
2026-07-30 | |
| GHSA-964w-f6gj-5236 | CVE-2026-66064 | MODERATE |
goshs has ACL Bypass & Path Traversal |
2026-07-28 | |
| GHSA-r5jh-q2mw-gcx4 | CVE-2026-50568 | LOW |
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape |
2026-07-28 | |
| GHSA-j99q-93c9-h869 | CVE-2026-57441 | MODERATE |
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence |
2026-07-20 | |
| GHSA-5474-4w2j-mq4c | CVE-2026-34451 | MODERATE |
Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories |
2026-04-24 | |
| GHSA-x732-6j76-qmhm | - | HIGH |
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits |
2025-12-16 | |
| GHSA-7rxf-gvfg-47g4 | CVE-2024-6839 | MODERATE |
Flask-CORS improper regex path matching vulnerability |
2025-11-03 | |
| GHSA-prpg-p95c-32fv | CVE-2024-12217 | MODERATE |
Gradio Path Traversal vulnerability |
2025-03-21 | |
| GHSA-m8rp-vv92-46c7 | CVE-2024-45405 | MODERATE | - |
gix-path improperly resolves configuration path reported by Git |
2024-09-18 |