The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.
This can be used by an attacker to bypass the validation and launch attacks that expose weaknesses that would otherwise be prevented, such as injection.

Primary

Validate-before-cleanse

Implementation

Access Control
Bypass Protection Mechanism

Implementation
Architecture and Design
Inputs should be decoded and canonicalized to the application's current internal representation before being filtered.

This script creates a subdirectory within a user directory and sets the user as the owner.

function createDir($userName,$dirName){$userDir = '/users/'. $userName;if(strpos($dirName,'..') !== false){echo 'Directory name contains invalid sequence';return;}
//filter out '~' because other scripts identify user directories by this prefix
$dirName = str_replace('~','',$dirName);$newDir = $userDir . $dirName;mkdir($newDir, 0700);chown($newDir,$userName);}

While the script attempts to screen for '..' sequences, an attacker can submit a directory path including ".~.", which will then become ".." after the filtering step. This allows a Path Traversal (CWE-21) attack to occur.

CVE-2002-0934
Directory traversal vulnerability allows remote attackers to read or modify arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
https://www.cve.org/CVERecord?id=CVE-2002-0934

CVE-2003-0282
Directory traversal vulnerability allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
https://www.cve.org/CVERecord?id=CVE-2003-0282

Protection Mechanism

Validate-Before-Filter

A1
Unvalidated Input
CWE More Specific

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This category is probably under-studied.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

Veracode
2008-08-15
Suggested OWASP Top Ten 2004 mapping

CWE Content Team
MITRE
2008-09-08
updated Functional_Areas, Relationships, Research_Gaps, Taxonomy_Mappings, Type

CWE Content Team
MITRE
2008-10-14
updated Description

CWE Content Team
MITRE
2010-06-21
updated Description, Observed_Examples

CWE Content Team
MITRE
2011-03-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, Observed_Examples, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2019-01-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2020-02-24
updated Relationships, Type

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Validate-before-filter