CWE · MITRE source
CWE-73External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
This could allow an attacker to access or modify system files or other files that are critical to the application. Path manipulation errors occur when the following two conditions are met: For example, the program may give the attacker the ability to overwrite the specified file or run with a configuration controlled by the attacker.
Last updated: 22 August 2026 20:22 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 8 mapping(s) from 1 framework(s): CAPEC 8 (partial)
OWASP Top 10 for Web (2025)
This weakness contributes to A06:2025 Insecure Design.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls that address this weakness (1)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-10 | Information Input Validation | SI | Rejects externally supplied file or resource identifiers that fail validity checks. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2018-17246 UPD | 9.9 | 9.8 | 0.8225 | 2018-12-20 |
CVE-2022-39952 UPD | 9.9 | 9.8 | 0.9981 | 2023-02-16 |
CVE-2023-4634 UPD | 9.9 | 9.8 | 0.8258 | 2023-09-06 |
CVE-2024-8517 UPD | 9.9 | 9.8 | 0.9461 | 2024-09-06 |
CVE-2024-46909 UPD | 9.3 | 9.8 | 0.4917 | 2024-12-02 |
CVE-2020-1631 KEV UPD | 9.2 | 8.8 | 0.0473 | 2020-05-04 |
CVE-2025-33053 KEV UPD | 9.2 | 8.8 | 0.8529 | 2025-06-10 |
CVE-2025-0851 UPD | 8.6 | 9.8 | 0.2327 | 2025-01-29 |
CVE-2023-3643 UPD | 8.3 | 7.3 | 0.7536 | 2023-07-12 |
CVE-2022-24900 UPD | 7.9 | 9.9 | 0.0841 | 2022-04-29 |
CVE-2023-36019 UPD | 7.9 | 9.6 | 0.1585 | 2023-12-12 |
CVE-2025-0105 UPD | 7.9 | 9.1 | 0.1327 | 2025-01-11 |
CVE-2026-33309 | 7.9 | 9.9 | 0.1106 | 2026-03-24 |
CVE-2025-71334 | 7.9 | 9.8 | 0.0390 | 2026-06-25 |
CVE-2024-43451 KEV UPD | 7.7 | 6.5 | 0.8411 | 2024-11-12 |
CVE-2025-0111 KEV UPD | 7.7 | 6.5 | 0.0196 | 2025-02-12 |
CVE-2025-24054 KEV UPD | 7.7 | 6.5 | 0.5891 | 2025-03-11 |
CVE-2021-27250 UPD | 7.6 | 6.5 | 0.6739 | 2021-04-14 |
CVE-2024-0087 UPD | 7.6 | 9.0 | 0.1992 | 2024-05-14 |
CVE-2026-11526 UPD | 7.6 | 9.8 | 0.0135 | 2026-06-14 |
CVE-2020-9752 UPD | 7.5 | 9.8 | 0.0115 | 2020-03-23 |
CVE-2021-38477 UPD | 7.5 | 9.8 | 0.0115 | 2021-10-22 |
CVE-2023-47862 UPD | 7.5 | 9.8 | 0.0106 | 2024-01-10 |
CVE-2025-6463 UPD | 7.5 | 8.8 | 0.1177 | 2025-07-02 |
CVE-2026-39907 UPD | 7.5 | 10.0 | 0.0062 | 2026-04-14 |