CWE-177.

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

• Broken access control
• CWE-177

<4.16.0 · fixed in 4.16.0

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

• CWE-177
• CWE-180

>=0.3.0, <1.20.2 · fixed in 1.20.2

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

• CWE-177

>=3.5.0, <4.18.2 · fixed in 4.18.2

Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

• Cisco Catalyst SD-WAN Manager
• CWE-177

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

• CWE-177

>=2.3.1, <2.4.5 || >=3.0.0, <3.1.6 || >=4.0.0, <4.1.3 · fixed in 2.4.5, 3.1.6, 4.1.3

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

• Information disclosure
• CWE-177

>=1.29.0, <1.30.6 · fixed in 1.30.6

Velociraptor Stored XSS in URL column types

• Rapid7 Velociraptor
• CWE-177

Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

• Apache Software Foundation Apache Tomcat
• CWE-177

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.

• CWE-177

>=1.0.0, <1.2.1 · fixed in 1.2.1

@fastify/static vulnerable to route guard bypass via encoded path separators

• CWE-177

>=8.0.0, <9.1.1 · fixed in 9.1.1

Hono vulnerable to arbitrary file access via serveStatic vulnerability

• CWE-177

<4.12.4 · fixed in 4.12.4

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

• Authentication bypass
• CWE-177

<4.0.3 · fixed in 4.0.3

Fastify Middie Middleware Path Bypass

• CWE-177

<9.1.0 · fixed in 9.1.0

Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass

• Path traversal
• CWE-20

>=1.3.0, <1.8.0 · fixed in 1.8.0

Improper Handling of URL Encoding (Hex Encoding) in GitLab

• GitLab
• CWE-177

QTS, QuTS hero

• QNAP Systems Inc. QTS
• QNAP Systems Inc. QuTS hero
• CWE-177

Access rules for PingAccess may be circumvented with URL-encoded characters

• Ping Identity PingAccess
• CWE-20
• CWE-177

Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass

• CWE-20
• CWE-177

<2.10.6 · fixed in 2.10.6

A flaw was found in Ceph, relating to the URL processing on RGW backends.

• ceph
• CWE-177

Keycloak vulnerable to path traversal via double URL encoding

• Path traversal
• CWE-177

<20.0.2 · fixed in 20.0.2

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.F…

• https://github.com/curl/curl
• CWE-177

vercel/serve allows access to restricted files if filename is URL encoded.

• CWE-177

<6.5.2 · fixed in 6.5.2

Path Traversal in superstatic

• CWE-177

<5.0.2 · fixed in 5.0.2