CVE-2023-29446

Enforced access authorizations can limit damage from a traversed UNC path even if the path itself is accepted.

Requiring documented development standards and tools can embed input-validation practices into the engineering process.

Identifying and recording vulnerabilities enables discovery and remediation of path traversal flaws before exploitation.

Least-privilege enforcement limits the damage an attacker can achieve via a malicious UNC path.

Secure SDLC practices directly prevent introduction of unsafe path-handling code such as UNC traversal.

Network security controls can block or filter UNC paths that traverse outside approved shares.

A.8.25 mandates security requirements, secure coding guidelines, checkpoints, testing (incl. code scans) and developer training in the SDLC, which reaches a slice of input validation defects but leaves the majority (incomplete enforcement, second-order inputs, parser differentials, post-validation canonicalization) unaddressed as in the SA-3 and A.8.28 anchors.

Application security requirements can mandate input validation to reject malicious UNC paths.

A.8.27 mandates security-by-design, defence-in-depth, least privilege, distrust-external-input, fail-securely and security-oriented design reviews that can catch and block path-traversal patterns in the architecture and code; this stops exploitation for many but not all instances (e.g. those arising from third-party libraries, runtime configuration, or post-review changes), leaving a bounded remainder.

Secure coding standards directly require validation and sanitization of file paths including UNC shares.