Common Weakness Enumeration
CWE-424 Improper Protection of Alternate Path
Description
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-424 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-25gq-j9jx-43pg | CVE-2026-58428 | MODERATE |
Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) |
2026-07-21 | |
| GHSA-2cpp-j2fc-qhp7 | CVE-2026-4270 | MODERATE |
AWS API MCP File Access Restriction Bypass |
2026-06-08 | |
| GHSA-263q-5cv3-xq9g | CVE-2025-68939 | HIGH |
Gitea allows attackers to add attachments with forbidden file extensions |
2025-12-26 | |
| GHSA-ggwg-cmwp-46r5 | CVE-2024-58136 | CRITICAL | - |
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key |
2025-10-22 |