CWE-41 · File and Path Handling
Improper Resolution of Path Equivalence
44CVEs
SortMost likely exploited
44 CVEs with CWE-41 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-21269Windows HTML Platforms Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.3 · 2025-01-14 | 4.3 | 4.5% | 2025-01-14 |
| CVE-2023-45283Insecure parsing of Windows paths with a \??\ prefix in path/filepathGo standard library · path/filepath · 2023-11-09 | – | 3.3% | 2023-11-09 |
| CVE-2025-21247MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.3 · 2025-03-11 | 4.3 | 3.1% | 2025-03-11 |
| CVE-2025-21219MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.3 · 2025-01-14 | 4.3 | 3.0% | 2025-01-14 |
| CVE-2025-21189MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.3 · 2025-01-14 | 4.3 | 2.9% | 2025-01-14 |
| CVE-2024-30036Windows Deployment Services Information Disclosure VulnerabilityMicrosoft · Windows Server 2019 · CVSS 6.5 · 2024-05-14 | 6.5 | 2.3% | 2024-05-14 |
| CVE-2025-21268MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.3 · 2025-01-14 | 4.3 | 1.9% | 2025-01-14 |
| CVE-2023-36396Windows Compressed Folder Remote Code Execution VulnerabilityMicrosoft · Windows 11 version 22H2 · CVSS 7.8 · 2023-11-14 | 7.8 | 1.7% | 2023-11-14 |
| CVE-2025-21332MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.3 · 2025-01-14 | 4.3 | 1.5% | 2025-01-14 |
| CVE-2025-21329MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.3 · 2025-01-14 | 4.3 | 1.5% | 2025-01-14 |
| CVE-2025-21328MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.3 · 2025-01-14 | 4.3 | 1.5% | 2025-01-14 |
| CVE-2026-23674MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.5 · 2026-03-10 | 7.5 | 1.4% | 2026-03-10 |
| CVE-2025-24470An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.11 may allow a remote unauthenticated…Fortinet · FortiPortal · CVSS 8.1 · 2025-02-11 | 8.1 | 1.3% | 2025-02-11 |
| CVE-2026-102217WebDAV Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 8.8 · 2026-10-13 | 8.8 | 1.3% | 2026-10-13 |
| CVE-2023-45284Incorrect detection of reserved device names on Windows in path/filepathGo standard library · path/filepath · CVSS 5.3 · 2023-11-09 | 5.3 | 1.1% | 2023-11-09 |
| CVE-2022-0855Improper Resolution of Path Equivalence in microweber-dev/whmcs_pluginmicroweber-dev · microweber-dev/whmcs_plugin · CVSS 7.4 · 2022-03-04 | 7.4 | 1.0% | 2022-03-04 |
| CVE-2026-108463Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 8.8 · 2026-10-13 | 8.8 | 1.0% | 2026-10-13 |
| CVE-2025-54107MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.3 · 2025-09-09 | 4.3 | 1.0% | 2025-09-09 |
| CVE-2026-88136Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 8.8 · 2026-10-13 | 8.8 | 1.0% | 2026-10-13 |
| CVE-2024-30073Windows Security Zone Mapping Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.8 · 2024-09-10 | 7.8 | 0.9% | 2024-09-10 |
| CVE-2024-8765Improper Path Equivalence Resolution in lunary-ai/lunarylunary-ai · lunary-ai/lunary · CVSS 7.3 · 2025-03-20 | 7.3 | 0.8% | 2025-03-20 |
| CVE-2026-73019Windows URL Moniker Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 4.3 · 2026-09-08 | 4.3 | 0.8% | 2026-09-08 |
| CVE-2024-6839Improper Regex Path Matching in corydolphin/flask-corscorydolphin · corydolphin/flask-cors · CVSS 4.3 · 2025-03-20 | 4.3 | 0.7% | 2025-03-20 |
| CVE-2026-114156ASP.NET Core Security Feature Bypass VulnerabilityMicrosoft · .NET 11.0 installed on Linux · CVSS 6.5 · 2026-11-10 | 6.5 | 0.6% | 2026-11-10 |
| CVE-2023-46169IBM DS8900F file manipulationIBM · DS8900F · CVSS 6.5 · 2024-03-07 | 6.5 | 0.5% | 2024-03-07 |
| CVE-2026-72835filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalizationfilebrowser · filebrowser · CVSS 6.8 · 2026-08-14 | 6.8 | 0.5% | 2026-08-14 |
| CVE-2026-112343Syncplify Server! < 8.8.0 Permission Override Bypass via Path CasingSyncplify, Inc. · Syncplify Server! · CVSS 8.1 · 2026-10-26 | 8.1 | 0.5% | 2026-10-26 |
| CVE-2026-93709Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handlerNo vendor recorded · CVSS 5.3 · 2026-09-22 | 5.3 | 0.5% | 2026-09-22 |
| CVE-2026-66064goshs has ACL Bypass & Path Traversalgoshs-labs · goshs · CVSS 5.3 · 2026-07-28 | 5.3 | 0.4% | 2026-07-28 |
| CVE-2026-70184Windows Backup Engine Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 21H2 · CVSS 7.8 · 2026-10-13 | 7.8 | 0.4% | 2026-10-13 |
| CVE-2026-5816Improper Resolution of Path Equivalence in GitLabGitLab · GitLab · CVSS 8 · 2026-04-22 | 8.0 | 0.4% | 2026-04-22 |
| CVE-2026-127091Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical PathsJadaptive · Maverick Synergy Server · CVSS 6.8 · 2026-11-13 | 6.8 | 0.4% | 2026-11-13 |
| CVE-2026-102231Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft · Visual Studio Code · CVSS 7.7 · 2026-10-13 | 7.7 | 0.4% | 2026-10-13 |
| CVE-2026-119200Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesnuxt · nuxt · CVSS 6.5 · 2026-10-29 | 6.5 | 0.3% | 2026-10-29 |
| CVE-2026-34510OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media LoadersOpenClaw · OpenClaw · CVSS 5.3 · 2026-04-01 | 5.3 | 0.3% | 2026-04-01 |
| CVE-2026-110725fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesfast-uri · fast-uri · CVSS 3.7 · 2026-10-20 | 3.7 | 0.3% | 2026-10-20 |
| CVE-2026-110095fast-uri vulnerable to improper path equivalence in relative reference normalizationfast-uri · fast-uri · CVSS 3.7 · 2026-10-20 | 3.7 | 0.3% | 2026-10-20 |
| CVE-2024-45405gix-path improperly resolves configuration path reported by GitByron · gitoxide · CVSS 6 · 2024-09-06 | 6.0 | 0.3% | 2024-09-06 |
| CVE-2025-43298A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An ap…Apple · macOS · CVSS 7.8 · 2025-09-15 | 7.8 | 0.2% | 2025-09-15 |
| CVE-2026-57441MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalencebitbonsai · mcpvault · CVSS 8.4 · 2026-09-15 | 8.4 | 0.2% | 2026-09-15 |
| CVE-2026-49401Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)denoland · deno · CVSS 7.3 · 2026-06-23 | 7.3 | 0.2% | 2026-06-23 |
| CVE-2025-0115PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLIPalo Alto Networks · PAN-OS · CVSS 6.8 · 2025-03-12 | 6.8 | 0.2% | 2025-03-12 |
| CVE-2026-50568Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escapefission · fission · CVSS 3.6 · 2026-06-10 | 3.6 | 0.1% | 2026-06-10 |
| CVE-2025-58290Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.Huawei · HarmonyOS · CVSS 3.3 · 2025-10-11 | 3.3 | 0.1% | 2025-10-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.