CWE-706.

File Browser: Colliding username normalization gives two users the same home directory

• CWE-647
• CWE-706

<2.63.17 · fixed in 2.63.17

nextlevelbuilder GoClaw exec_approval.go extractBin name resolution

• nextlevelbuilder GoClaw
• CWE-706

OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper

• OpenClaw
• Broken access control
• CWE-706

Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs

• Juniper Networks Junos OS
• CWE-706

Use of Incorrectly-Resolved Name or Reference in GitLab

• GitLab
• CWE-706

cp: -R reads device nodes as streams, destroying device semantics

• Denial of service
• CWE-706

<0.7.0 · fixed in 0.7.0

Devolutions Remote Desktop Manager: Incorrect link resolution by display name in the custom PowerShell VPN editor in…

• Devolutions Remote Desktop Manager
• CWE-706

Devolutions UniGetUI: Use of an incorrectly resolved name or reference in the pinget backend in Devolutions…

• Devolutions UniGetUI
• CWE-706

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

• Broken access control
• CWE-706

<0.8.11 · fixed in 0.8.11

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

• CWE-20
• CWE-706

<1.3.0 · fixed in 1.3.0

Use of Incorrectly-Resolved Name or Reference in GitLab

• GitLab
• CWE-706

pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

• CWE-706

<=0.5.0b3.dev99 · no fixed version yet

Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

• CWE-345
• CWE-706

>=0.24.0, <0.26.0 · fixed in 0.26.0

Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync

• Path traversal
• CWE-706

<=1.7.34 · no fixed version yet

Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

• CWE-706

<2026.4.2 · fixed in 2026.4.2

OpenFGA has Improper Policy Enforcement

• Broken access control
• CWE-706

<1.14.1 · fixed in 1.14.1

Duplicate Advisory: uutils coreutils Uses Incorrectly-Resolved Name or Reference

• CWE-706

<0.7.0 · fixed in 0.7.0

Duplicate Advisory: OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision

• CWE-706

<2026.3.22 · fixed in 2026.3.22

OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

• CWE-349
• CWE-440

<2026.4.2 · fixed in 2026.4.2

fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

• CWE-345
• CWE-706

>=0.0.1, <6.2.0 · fixed in 6.2.0

OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass

• Authentication bypass
• CWE-706

<2026.3.31 · fixed in 2026.3.31

OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision

• Broken access control
• CWE-706

<2026.3.22 · fixed in 2026.3.22

OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper

• Broken access control
• CWE-706

<2026.3.22 · fixed in 2026.3.22

OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

• Broken access control
• CWE-706

<2026.3.22 · fixed in 2026.3.22

srvx is vulnerable to middleware bypass via absolute URI in request line

• CWE-706

<0.11.13 · fixed in 0.11.13

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

• CWE-706

>=2.0.1-alpha.0, <2.0.1-rc.17 · fixed in 2.0.1-rc.17

Use of Incorrectly-Resolved Name or Reference in GitLab

• GitLab
• CWE-706

WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection

• CWE-706

<0.3.0 · fixed in 0.3.0

opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass

• Server-side request forgery (SSRF)
• CWE-706

<1.17.1 · fixed in 1.17.1

File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

• Broken access control
• CWE-706

<2.57.1 · fixed in 2.57.1

SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion

• SmarterTools SmarterMail
• CWE-706

Singularity ineffectively applies of selinux / apparmor LSM process labels in github.com/sylabs/singularity

• CWE-61
• CWE-706

* · no fixed version yet

Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer

• CWE-61
• CWE-706

<1.4.5 · fixed in 1.4.5

zx Uses Incorrectly-Resolved Name or Reference

• CWE-706

<8.8.5 · fixed in 8.8.5

CommandKit has incorrect command name exposure in context object for message command aliases

• CWE-706

>=1.2.0-rc.1, <1.2.0-rc.12 · fixed in 1.2.0-rc.12

Hono's flaw in URL path parsing could cause path confusion

• CWE-706

>=4.8.0, <4.9.6 · fixed in 4.9.6

A10 Networks AX Loadbalancer Path Traversal

• A10 Networks AX Series Loadbalancer
• Path traversal
• CWE-706

NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion

• Nameless
• CWE-706

OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza

• CWE-706

* · no fixed version yet

Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.

• CWE-706

An insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0.

• CWE-706

Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews

• nextcloud security-advisories
• CWE-706

gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign

• CWE-706

<0.11.0 · fixed in 0.11.0

gix-path uses local config across repos when it is the highest scope

• CWE-706

>=0.0.0-0, <0.10.10 · fixed in 0.10.10

Nuxt vulnerable to remote code execution via the browser when running the test locally

• Code injection
• CWE-706

>=3.4.0, <3.12.4 · fixed in 3.12.4

TorchServe vulnerable to bypass of allowed_urls configuration

• Path traversal
• CWE-706

<0.11.0 · fixed in 0.11.0

Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability

• Avast Premium Security
• CWE-706

Directus has MySQL accent insensitive email matching

• CWE-706

<10.8.3 · fixed in 10.8.3

Docassemble unauthorized access through URL manipulation

• CWE-706

>=1.4.53, <1.4.97 · fixed in 1.4.97

Mastodon Invalid Domain Name Normalization vulnerability

• mastodon
• CWE-706

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

• Information disclosure
• CWE-50

<2.9.16 || >=3.0.2, <3.2.7 || >=4.0.0, <4.0.5 || >=4.1.0, <4.1.5 || >=4.2.0, <4.2.3 || >=4.3.0, <4.3.9 · fixed in 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, 4.3.9

D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/__lang_msg.php.

• CWE-706

Potential share collision for recipients when caching is enabled in nextcloud server

• nextcloud security-advisories
• CWE-706

lambdaisland/uri `authority-regex` returns the wrong authority

• Open redirect
• CWE-706

<1.14.120 · fixed in 1.14.120

Opencontainers runc Incorrect Authorization vulnerability

• CWE-706

>=1.0.0-rc95, <1.1.5 · fixed in 1.1.5

Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on th…

• CWE-706

An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution.

• CWE-706

An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution.

• CWE-706

Tauri Filesystem Scope can be Partially Bypassed

• Broken access control
• Information disclosure

>=1.0.0, <1.0.7 || >=1.1.0, <1.1.2 · fixed in 1.0.7, 1.1.2

Invalid file request can crash server

• CWE-252
• CWE-706

<4.10.12 || >=5.0.0, <5.2.3 · fixed in 4.10.12, 5.2.3