A software system that accepts path input in the form of multiple internal dot ('file...dir') without appropriate validation can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Time of Introduction
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Confidentiality
Integrity
Technical Impact: Read files or
directories; Modify files or
directories
Potential Mitigations
see the vulnerability category "Path Equivalence"
Other Notes
This variant does not have any easily findable, publicly reported
vulnerabilities, but it can be an effective manipulation in weaknesses such
as validate-before-cleanse, which might use a regular expression that
removes ".." sequences from a string to produce an unexpected string.
Description
