recorded together · two weakness classes
Input Validation and Logic and File and Path Handling
32 CVEs · 1 exploited
32 CVEs name a weakness of both Input Validation and Logic and File and Path Handling, fewer than chance alone would give (about 110). The pairing most often behind it is CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize) with CWE-22 (Path Traversal), in 4 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 32
- Chance alone would give
- about 110
- So they are recorded together
- less often than chance (0.3×)
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial from 25 CVEs and 1.15 times chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
- exploited in the wild
- 1
Every one of the 32 is a mark on the map. Named now: 1 to 26, most at risk first.
- Git allows arbitrary code execution through broken config quoting
- Cupsd Listen arbitrary chmod 0140777
- A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.
- Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write
- Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.
- FUXA has a Path Traversal Sanitization Bypass
- Wasmtime doesn't fully sandbox all the Windows device filenames
- Vikunja has Path Traversal in CLI Restore
- Alertmanager can expose local files content via specially crafted config
- Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- @fastify/http-proxy vulnerable to prefix escape via decoded route parameters
- @fastify/static vulnerable to route guard bypass via non-canonical path segments
- Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
- baserCMS: Encoded path traversal bypass in the theme file API
- zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write
- Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)
- OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
- Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)
- SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets
- Genians, Inc Genian NAC/ZTNA Remote Code Execution
- Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
- TYPO3 CMS - Security Misconfiguration in Form Framework
- Heimdall: Authorization bypass via path normalization mismatch
- Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
- Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier + pg_stat_file/pg_ls_* sibling gap)
- Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.