Advisories · Weakness
CWE-41.
Every Advisory and CVE whose sources give the weakness CWE-41, newest first.
- CVSS 6.5 Medium
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
- Broken access control
- CWE-41
>=4.6.0, <4.6.3 · fixed in 4.6.3
GHSA-9v7c-q64q-vv33 · CVE-2026-119200 - CVSS 8.6 High
Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing
- Syncplify, Inc. Syncplify Server!
- CWE-41
- CVSS 3.7 Low
fast-uri vulnerable to improper path equivalence in relative reference normalization
- CWE-41
<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3 · fixed in 2.4.8, 3.1.9, 4.2.3
GHSA-xhq7-xmqj-769h · CVE-2026-110095 - CVSS 3.7 Low
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
- CWE-41
- CWE-116
<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3 · fixed in 2.4.8, 3.1.9, 4.2.3
GHSA-333x-w4r6-6crp · CVE-2026-110725 - CVSS 8.8 High
Windows SmartScreen Security Feature Bypass Vulnerability
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
- CWE-41
- CVSS 8.8 High
WebDAV Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-41
- CVSS 7.8 High
Windows Backup Engine Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 21H2
- Microsoft Windows 10 Version 22H2
- CWE-41
- CVSS 8.8 High
Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-41
- CVSS 7.7 High
Visual Studio Code Security Feature Bypass Vulnerability
- Microsoft Visual Studio Code
- CWE-41
- CVSS 5.3 Medium
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler
- CWE-41
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated Remote Code Execution in Akana API Platform
- Perforce Akana
- Code injection
- Broken access control
- CVSS 4.3 Medium
Windows URL Moniker Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-41
- CVSS 7.6 High
filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
- filebrowser
- CWE-41
- CVSS 7.5 High
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
- Authentication bypass
- Broken access control
<3.20.6.2 || >=3.21.0.CR1, <3.27.4.1 || >=3.28.0.CR1, <3.33.2.1 || >=3.34.0.CR1, <3.36.3 || >=3.37.0.CR1, <3.37.0 · fixed in 3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, 3.37.0
GHSA-qcxp-gm7m-4j5v · CVE-2026-50559 - CVSS 5.3 Medium
goshs has ACL Bypass & Path Traversal
- Path traversal
- Broken access control
<=1.1.4 · no fixed version yet
GHSA-964w-f6gj-5236 · CVE-2026-66064 - CVSS 3.6 Low
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
- CWE-41
<1.25.0 · fixed in 1.25.0
GHSA-r5jh-q2mw-gcx4 · CVE-2026-50568 - CVSS 8.4 High
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
- CWE-41
- CWE-178
<0.11.4 · fixed in 0.11.4
GHSA-j99q-93c9-h869 · CVE-2026-57441 - CVSS 7.3 High
Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- CWE-41
- CWE-176
<2.7.14 · fixed in 2.7.14
GHSA-8xpq-cjcf-3wh9 · CVE-2026-49401 - CVSS 8.0 High
Improper Resolution of Path Equivalence in GitLab
- GitLab
- CWE-41
- CVSS 6.9 Medium
OpenClaw: Windows-compatible env override keys could bypass system.run approval binding
- CWE-41
- CWE-178
<2026.4.2 · fixed in 2026.4.2
GHSA-98ch-45wp-ch47 · CVE-2026-34426 - CVSS 6.3 Medium
Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories
- Path traversal
- CWE-41
>=0.79.0, <0.81.0 · fixed in 0.81.0
GHSA-5474-4w2j-mq4c · CVE-2026-34451 - CVSS 7.5 High
MapUrlToZone Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-41
- CVSS 8.8 High
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
- Denial of service
- CWE-20
<1.4.5 · fixed in 1.4.5
GHSA-x732-6j76-qmhm · CVE-2025-71399 - CVSS 3.3 Low
Denial of service (DoS) vulnerability in the office service.
- Huawei HarmonyOS
- CWE-41
- CVSS 7.8 High
A parsing issue in the handling of directory paths was addressed with improved path validation.
- Apple macOS
- CWE-41
- CVSS 4.3 Medium
MapUrlToZone Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 4.3 Medium
Flask-CORS improper regex path matching vulnerability
- CWE-41
<6.0.0 · fixed in 6.0.0
GHSA-7rxf-gvfg-47g4 · CVE-2024-6839 - CVSS 5.3 Medium
Gradio Path Traversal vulnerability
- Path traversal
- CWE-41
<=5.0.1 · no fixed version yet
GHSA-prpg-p95c-32fv · CVE-2024-12217 - CVSS 7.3 High
Improper Path Equivalence Resolution in lunary-ai/lunary
- lunary-ai/lunary
- CWE-41
- CVSS 6.8 Medium
PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-41
- CVSS 4.3 Medium
MapUrlToZone Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 8.1 High
Fortinet FortiPortal: An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0…
- Fortinet FortiPortal
- CWE-41
- CVSS 4.3 Medium
MapUrlToZone Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 4.3 Medium
MapUrlToZone Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 4.3 Medium
MapUrlToZone Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 4.3 Medium
MapUrlToZone Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 4.3 Medium
MapUrlToZone Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 4.3 Medium
Windows HTML Platforms Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 4.3 Medium
MapUrlToZone Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 7.8 High
Windows Security Zone Mapping Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-41
- CVSS 6.0 Medium
gix-path improperly resolves configuration path reported by Git
- CWE-41
- CWE-427
>=0.0.0-0, <0.10.11 · fixed in 0.10.11
GHSA-m8rp-vv92-46c7 · CVE-2024-45405 - CVSS 6.5 Medium
Windows Deployment Services Information Disclosure Vulnerability
- Microsoft Windows Server 2019
- Microsoft Windows Server 2019 (Server Core installation)
- CWE-41
- CVSS 6.5 Medium
IBM DS8900F file manipulation
- IBM DS8900F
- CWE-41
- CVSS 7.8 High
Windows Compressed Folder Remote Code Execution Vulnerability
- Microsoft Windows 11 version 22H2
- Microsoft Windows 11 version 22H3
- CWE-41
- CVSS 7.4 High
Improper Resolution of Path Equivalence in microweber-dev/whmcs_plugin
- microweber-dev/whmcs_plugin
- CWE-41