A software system that accepts path input in the form of
internal dot ('file.ordir') without appropriate validation can lead to ambiguous
path resolution and allow an attacker to traverse the file system to unintended
locations or access arbitrary files.
Time of Introduction
Implementation
Applicable Platforms
Languages
All
Potential Mitigations
Phase
Description
see the vulnerability category "Path Equivalence"
Other Notes
This variant does not have any easily findable, publicly reported
vulnerabilities, but it can be an effective manipulation in weaknesses such
as validate-before-cleanse, which might remove a dot from a string to
produce an unexpected string.
Description
