# CWE-41.

Every Advisory and CVE whose sources give the weakness CWE-41, newest first.

## Records, newest first

- [Nuxt: Dot segments in the request path bypass \`server/middleware\` path checks and server route rules on page routes](https://agentprime.io/advisories/GHSA-9v7c-q64q-vv33.md)
  `GHSA-9v7c-q64q-vv33`, `CVE-2026-119200` · npm `nuxt` and 1 more: affected `>=4.6.0, <4.6.3`, fixed in `4.6.3` · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control, CWE-41, CWE-436
- [Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing](https://agentprime.io/advisories/CVE-2026-112343.md)
  `CVE-2026-112343` · CVE record: Syncplify, Inc. Syncplify Server! · CVSS 8.6 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-41
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://agentprime.io/advisories/GHSA-xhq7-xmqj-769h.md)
  `GHSA-xhq7-xmqj-769h`, `CVE-2026-110095` · npm `fast-uri`: affected `<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3`, fixed in `2.4.8`, `3.1.9`, `4.2.3` · CVSS 3.7 Low · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-41
- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://agentprime.io/advisories/GHSA-333x-w4r6-6crp.md)
  `GHSA-333x-w4r6-6crp`, `CVE-2026-110725` · npm `fast-uri`: affected `<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3`, fixed in `2.4.8`, `3.1.9`, `4.2.3` · CVSS 3.7 Low · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-41, CWE-116
- [Windows SmartScreen Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-108463.md)
  `CVE-2026-108463` · CVE record: Microsoft Windows 11 Version 24H2 and 3 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-41
- [WebDAV Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-102217.md)
  `CVE-2026-102217` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-41
- [Windows Backup Engine Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70184.md)
  `CVE-2026-70184` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-41
- [Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-88136.md)
  `CVE-2026-88136` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-41
- [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-102231.md)
  `CVE-2026-102231` · CVE record: Microsoft Visual Studio Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-41
- [Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler](https://agentprime.io/advisories/CVE-2026-93709.md)
  `CVE-2026-93709` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-41
- [Unauthenticated Remote Code Execution in Akana API Platform](https://agentprime.io/advisories/CVE-2026-85978.md)
  `CVE-2026-85978` · CVE record: Perforce Akana · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Code injection, Broken access control, CWE-41
- [Windows URL Moniker Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-73019.md)
  `CVE-2026-73019` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-41
- [filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization](https://agentprime.io/advisories/CVE-2026-72835.md)
  `CVE-2026-72835` · CVE record: filebrowser filebrowser · CVSS 7.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-41
- [Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities](https://agentprime.io/advisories/GHSA-qcxp-gm7m-4j5v.md)
  `GHSA-qcxp-gm7m-4j5v`, `CVE-2026-50559` · Maven `io.quarkus:quarkus-vertx-http`: affected `<3.20.6.2 || >=3.21.0.CR1, <3.27.4.1 || >=3.28.0.CR1, <3.33.2.1 || >=3.34.0.CR1, <3.36.3 || >=3.37.0.CR1, <3.37.0`, fixed in `3.20.6.2`, `3.27.4.1`, `3.33.2.1`, `3.36.3`, `3.37.0` · CVSS 7.5 High · Not analysed yet · Published 29 Jul 2026 · Tags: Authentication bypass, Broken access control, CWE-41, CWE-178
- [goshs has ACL Bypass & Path Traversal](https://agentprime.io/advisories/GHSA-964w-f6gj-5236.md)
  `GHSA-964w-f6gj-5236`, `CVE-2026-66064`, `GO-2026-6134` · Go `github.com/patrickhener/goshs` and 3 more: affected `<=1.1.4`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal, Broken access control, CWE-41
- [Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape](https://agentprime.io/advisories/GHSA-r5jh-q2mw-gcx4.md)
  `GHSA-r5jh-q2mw-gcx4`, `CVE-2026-50568`, `GO-2026-6130` · Go `github.com/fission/fission`: affected `<1.25.0`, fixed in `1.25.0` · CVSS 3.6 Low · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-41
- [MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence](https://agentprime.io/advisories/GHSA-j99q-93c9-h869.md)
  `GHSA-j99q-93c9-h869`, `CVE-2026-57441` · npm `@bitbonsai/mcpvault`: affected `<0.11.4`, fixed in `0.11.4` · CVSS 8.4 High · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-41, CWE-178
- [Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)](https://agentprime.io/advisories/GHSA-8xpq-cjcf-3wh9.md)
  `GHSA-8xpq-cjcf-3wh9`, `CVE-2026-49401` · crates.io `deno`: affected `<2.7.14`, fixed in `2.7.14` · CVSS 7.3 High · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-41, CWE-176
- [Improper Resolution of Path Equivalence in GitLab](https://agentprime.io/advisories/CVE-2026-5816.md)
  `CVE-2026-5816` · CVE record: GitLab GitLab · CVSS 8.0 High · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-41
- [OpenClaw: Windows-compatible env override keys could bypass system.run approval binding](https://agentprime.io/advisories/GHSA-98ch-45wp-ch47.md)
  `GHSA-98ch-45wp-ch47`, `CVE-2026-34426`, `CVE-2026-34510`, `GHSA-h3x4-hc5v-v2gm` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-41, CWE-178, CWE-184
- [Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories](https://agentprime.io/advisories/GHSA-5474-4w2j-mq4c.md)
  `GHSA-5474-4w2j-mq4c`, `CVE-2026-34451` · npm `@anthropic-ai/sdk`: affected `>=0.79.0, <0.81.0`, fixed in `0.81.0` · CVSS 6.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Path traversal, CWE-41
- [MapUrlToZone Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-23674.md)
  `CVE-2026-23674` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-41
- [Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits](https://agentprime.io/advisories/GHSA-x732-6j76-qmhm.md)
  `GHSA-x732-6j76-qmhm`, `CVE-2025-71399` · npm `better-auth`: affected `<1.4.5`, fixed in `1.4.5` · CVSS 8.8 High · Not analysed yet · Published 16 Dec 2025 · Tags: Denial of service, CWE-20, CWE-41
- [Denial of service (DoS) vulnerability in the office service.](https://agentprime.io/advisories/CVE-2025-58290.md)
  `CVE-2025-58290` · CVE record: Huawei HarmonyOS · CVSS 3.3 Low · Not analysed yet · Published 11 Oct 2025 · Tags: CWE-41
- [A parsing issue in the handling of directory paths was addressed with improved path validation.](https://agentprime.io/advisories/CVE-2025-43298.md)
  `CVE-2025-43298` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-41
- [MapUrlToZone Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-54107.md)
  `CVE-2025-54107` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-41
- [Flask-CORS improper regex path matching vulnerability](https://agentprime.io/advisories/GHSA-7rxf-gvfg-47g4.md)
  `GHSA-7rxf-gvfg-47g4`, `CVE-2024-6839`, `PYSEC-2026-1384` · PyPI `flask-cors`: affected `<6.0.0`, fixed in `6.0.0` · CVSS 4.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-41
- [Gradio Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-prpg-p95c-32fv.md)
  `GHSA-prpg-p95c-32fv`, `CVE-2024-12217`, `PYSEC-2026-1418` · PyPI `gradio`: affected `<=5.0.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Path traversal, CWE-41
- [Improper Path Equivalence Resolution in lunary-ai/lunary](https://agentprime.io/advisories/CVE-2024-8765.md)
  `CVE-2024-8765` · CVE record: lunary-ai lunary-ai/lunary · CVSS 7.3 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-41
- [PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI](https://agentprime.io/advisories/CVE-2025-0115.md)
  `CVE-2025-0115` · CVE record: Palo Alto Networks PAN-OS and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-41
- [MapUrlToZone Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-21247.md)
  `CVE-2025-21247` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 11 Mar 2025 · Tags: CWE-41
- [Fortinet FortiPortal: An Improper Resolution of Path Equivalence vulnerability \[CWE-41\] in FortiPortal 7.4.0…](https://agentprime.io/advisories/CVE-2025-24470.md)
  `CVE-2025-24470` · CVE record: Fortinet FortiPortal · CVSS 8.1 High · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-41
- [MapUrlToZone Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-21332.md)
  `CVE-2025-21332` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-41
- [MapUrlToZone Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-21189.md)
  `CVE-2025-21189` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-41
- [MapUrlToZone Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-21328.md)
  `CVE-2025-21328` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-41
- [MapUrlToZone Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-21329.md)
  `CVE-2025-21329` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-41
- [MapUrlToZone Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-21219.md)
  `CVE-2025-21219` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-41
- [Windows HTML Platforms Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-21269.md)
  `CVE-2025-21269` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-41
- [MapUrlToZone Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-21268.md)
  `CVE-2025-21268` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-41
- [Windows Security Zone Mapping Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2024-30073.md)
  `CVE-2024-30073` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-41
- [gix-path improperly resolves configuration path reported by Git](https://agentprime.io/advisories/GHSA-m8rp-vv92-46c7.md)
  `GHSA-m8rp-vv92-46c7`, `CVE-2024-45405`, `RUSTSEC-2024-0371` · crates.io `gix-path`: affected `>=0.0.0-0, <0.10.11`, fixed in `0.10.11` · CVSS 6.0 Medium · Not analysed yet · Published 6 Sept 2024 · Tags: CWE-41, CWE-427
- [Windows Deployment Services Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-30036.md)
  `CVE-2024-30036` · CVE record: Microsoft Windows Server 2019 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2024 · Tags: CWE-41
- [IBM DS8900F file manipulation](https://agentprime.io/advisories/CVE-2023-46169.md)
  `CVE-2023-46169` · CVE record: IBM DS8900F · CVSS 6.5 Medium · Not analysed yet · Published 7 Mar 2024 · Tags: CWE-41
- [Windows Compressed Folder Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-36396.md)
  `CVE-2023-36396` · CVE record: Microsoft Windows 11 version 22H2 and 2 more · CVSS 7.8 High · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-41
- [Improper Resolution of Path Equivalence in microweber-dev/whmcs_plugin](https://agentprime.io/advisories/CVE-2022-0855.md)
  `CVE-2022-0855` · CVE record: microweber-dev microweber-dev/whmcs_plugin · CVSS 7.4 High · Not analysed yet · Published 4 Mar 2022 · Tags: CWE-41

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-41>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-41/>. Everything for agents: <https://agentprime.io/llms.txt>.