CWE-641 · File and Path Handling
Improper Restriction of Names for Files and Other Resources
15CVEs
SortMost likely exploited
15 CVEs with CWE-641 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-25177Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 8.8 · 2026-03-10 | 8.8 | 1.4% | 2026-03-10 |
| CVE-2023-0046Improper Restriction of Names for Files and Other Resources in lirantal/daloradiuslirantal · lirantal/daloradius · CVSS 7.2 · 2023-01-04 | 7.2 | 1.1% | 2023-01-04 |
| CVE-2024-30063Windows Distributed File System (DFS) Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 6.7 · 2024-06-11 | 6.7 | 1.0% | 2024-06-11 |
| CVE-2025-21361Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft · Microsoft Office LTSC for Mac 2021 · CVSS 7.8 · 2025-01-14 | 7.8 | 0.8% | 2025-01-14 |
| CVE-2025-21402Microsoft Office OneNote Remote Code Execution VulnerabilityMicrosoft · Microsoft Office LTSC for Mac 2021 · CVSS 7.8 · 2025-01-14 | 7.8 | 0.7% | 2025-01-14 |
| CVE-2026-50023yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)yt-dlp · yt-dlp · CVSS 8.3 · 2026-06-23 | 8.3 | 0.7% | 2026-06-23 |
| CVE-2022-36302File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access different resources, which may contain sen…Bosch · BF-OS · CVSS 8.8 · 2022-08-01 | 8.8 | 0.6% | 2022-08-01 |
| CVE-2025-47173Microsoft Office Remote Code Execution VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 7.8 · 2025-06-10 | 7.8 | 0.6% | 2025-06-10 |
| CVE-2026-20282Cisco Identity Services Engine Authenticated Write VulnerabilityCisco · Cisco Identity Services Engine Software · CVSS 4.9 · 2026-09-16 | 4.9 | 0.6% | 2026-09-16 |
| CVE-2025-47953Microsoft Office Remote Code Execution VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 8.4 · 2025-06-10 | 8.4 | 0.6% | 2025-06-10 |
| CVE-2024-45312Arbitrary language parameter can passed to `aspell` executable via spelling requests in overleafoverleaf · overleaf · CVSS 5.3 · 2024-09-02 | 5.3 | 0.5% | 2024-09-02 |
| CVE-2024-4726051l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips th…Axis Communications AB · AXIS OS · CVSS 6.5 · 2025-03-04 | 6.5 | 0.4% | 2025-03-04 |
| CVE-2026-50510GitHub Copilot Remote Code Execution VulnerabilityMicrosoft · GitHub Copilot Plugin for JetBrains IDEs · CVSS 7.8 · 2026-07-14 | 7.8 | 0.4% | 2026-07-14 |
| CVE-2026-85864Python Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.8 · 2026-10-13 | 7.8 | 0.3% | 2026-10-13 |
| CVE-2019-25623Luminance Studio 2.17 Denial of Service via Malformed InputPixarra · Luminance Studio · CVSS 6.2 · 2026-03-23 | 6.2 | 0.2% | 2026-03-23 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.