CWE-180.

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

• Open redirect
• CWE-180

Vite: `server.fs.deny` bypassed with queries

• Broken access control
• CWE-180

>=6.4.4, <6.4.5 · fixed in 6.4.5

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

• CWE-172
• CWE-180

<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3 · fixed in 2.4.8, 3.1.9, 4.2.3

baserCMS: Encoded path traversal bypass in the theme file API

• baserproject basercms
• Path traversal
• CWE-180

Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization

• Zimbra Collaboration Suite
• CWE-180

ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

• ProjectSend
• CWE-180

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

• CWE-177
• CWE-180

>=0.3.0, <1.20.2 · fixed in 1.20.2

n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

• n8n
• CWE-180

Crafted Git build source can bypass certain policy validation

• moby BuildKit
• CWE-180

PeaZip: PeaZip before 11.3.0, in a non-default configuration…

• PeaZip
• CWE-180

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

• CWE-180

<2.14.0 · fixed in 2.14.0

stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

• stoatchat
• CWE-180

OpenClaw before 2026.8.1 Authentication Bypass via File URL

• OpenClaw
• CWE-180

input-leap Input Leap: Input Leap (aka input-leap) through 3.0.3…

• input-leap Input Leap
• CWE-180

django-allauth: django-allauth before 65.19.4 does not have the expected limits on failed login attempts…

• django-allauth
• CWE-180

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restri…

• Broken access control
• CWE-180

cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize

• cosmicstack-labs mercury-agent
• CWE-179
• CWE-180

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA.

• SEP sesam
• CWE-180

Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

• CWE-180

>=1.29.0-rc0, <3.32.2 · fixed in 3.32.2

The cohttp package before 6.3.0 for OCaml allows directory traversal.

• mirage cohttp
• CWE-180

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

• maalfer Pentestify
• CWE-180

AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

• Mintplex-Labs anything-llm
• Authentication bypass
• CWE-180

Guzzle: Noncanonical host can bypass host-based checks

• Server-side request forgery (SSRF)
• CWE-180

<7.15.2 || >=8.0.0, <8.0.1 · fixed in 7.15.2, 8.0.1

Guzzle: Noncanonical cookie domain keeps subdomain scope

• Authentication bypass
• CWE-180

<7.15.2 || >=8.0.0, <8.0.1 · fixed in 7.15.2, 8.0.1

Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

• copier
• Path traversal
• CWE-180

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

• CWE-180

<10.1.2 · fixed in 10.1.2

CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components

• Eclipse Foundation Eclipse BaSyx Go Components
• Broken access control
• CWE-180

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

• CWE-180

>=0.1.0, <0.41.3 · fixed in 0.41.3

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

• CWE-178
• CWE-180

>=4.5.0, <4.5.10 || >=4.6.0, <4.6.2 · fixed in 4.5.10, 4.6.2

ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass

• ModSecurity
• CWE-180

Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)

• kestra
• Path traversal
• Information disclosure

Warp: Env-var prefixes can lead to denylisted command autoexecution

• warp
• CWE-180
• CWE-693

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

• Weak cryptography or TLS
• CWE-180

<1.9.11 || >=1.10.0, <1.10.10 || >=2.0.0, <2.0.18 || >=2.1.0, <2.1.14 || >=2.2.0, <2.2.3 · fixed in 1.9.11, 1.10.10, 2.0.18, 2.1.14, 2.2.3

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

• CWE-180
• CWE-345

<5.19.0 · fixed in 5.19.0

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

• CWE-180

<4.12.12 · fixed in 4.12.12

Vite: `server.fs.deny` bypassed with queries

• Broken access control
• CWE-180

>=7.1.0, <7.3.2 || >=8.0.0, <8.0.5 · fixed in 7.3.2, 8.0.5

Rack:: Static header_rules bypass via URL-encoded paths

• CWE-180

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

varnish-software Varnish Cache: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12…

• varnish-software Varnish Cache
• CWE-180

OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

• Path traversal
• CWE-180

<2026.2.24 · fixed in 2026.2.24

Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport

• CWE-20
• CWE-180

<2.11.1 · fixed in 2.11.1

FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP

• CWE-20
• CWE-180

<1.11.2 · fixed in 1.11.2

NVIDIA DGX Spark: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware…

• NVIDIA DGX Spark
• CWE-180

A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9.

• Ivanti LANDesk Management Suite
• CWE-180

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

• Path traversal
• CWE-61

>=1.3.0, <2.3.0 · fixed in 2.3.0

librasean IP-Utils: The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses…

• librasean IP-Utils
• CWE-180

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.

• Atlassian Bamboo Server
• Atlassian Bamboo Data Center
• CWE-180

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps.

• Atlassian Bamboo Server
• Atlassian Bamboo Data Center
• CWE-180