The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.

Resultant

Alternate data streams (ADS) were first implemented in the Windows NT operating system to provide compatibility between NTFS and the Macintosh Hierarchical File System (HFS). In HFS, data and resource forks are used to store information about a file. The data fork provides information about the contents of the file while the resource fork stores metadata such as file type.

Implementation

Access Control
Non-Repudiation
Other
Bypass Protection Mechanism
Hide Activities
Other

Automated Analysis
Software tools are capable of finding ADSs on your system.

Implementation
Ensure that the source code correctly parses the filename to read or write to the correct stream.

CVE-1999-0278
In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.
https://www.cve.org/CVERecord?id=CVE-1999-0278

CVE-2000-0927
Product does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass quota restrictions.
https://www.cve.org/CVERecord?id=CVE-2000-0927

File Processing

System Process
File or Directory

Windows ::DATA alternate data stream

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This and similar problems exist because the same resource can have multiple identifiers that dictate which behavior can be performed on the resource.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Background_Details, Description, Relationships, Other_Notes, References, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Description

CWE Content Team
MITRE
2009-10-29
updated Other_Notes, Theoretical_Notes

CWE Content Team
MITRE
2010-04-05
updated Related_Attack_Patterns

CWE Content Team
MITRE
2010-12-13
updated Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Observed_Examples, References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, References, Relationships

CWE Content Team
MITRE
2018-03-27
updated References

CWE Content Team
MITRE
2019-01-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Detection_Factors, Potential_Mitigations, Weakness_Ordinalities

Windows ::DATA Alternate Data Stream
Failure to Handle Windows ::DATA Alternate Data Stream