The product accepts path input in the form of single dot directory exploit ('/./') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Primary

Resultant

Implementation

Confidentiality
Integrity
Read Files or Directories
Modify Files or Directories

Implementation
Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

CVE-2024-6091
Chain: AI agent platform does not restrict pathnames containing internal "/./" sequences (CWE-55), leading to an incomplete denylist (CWE-184) that does not prevent OS command injection (CWE-78)
https://www.cve.org/CVERecord?id=CVE-2024-6091

CVE-2000-0004
Server allows remote attackers to read source code for executable files by inserting a . (dot) into the URL.
https://www.cve.org/CVERecord?id=CVE-2000-0004

CVE-2002-0304
Server allows remote attackers to read password-protected files via a /./ in the HTTP request.
https://www.cve.org/CVERecord?id=CVE-2002-0304

CVE-1999-1083
Possibly (could be a cleansing error)
https://www.cve.org/CVERecord?id=CVE-1999-1083

CVE-2004-0815
"/./////etc" cleansed to ".///etc" then "/etc"
https://www.cve.org/CVERecord?id=CVE-2004-0815

CVE-2002-0112
Server allows remote attackers to view password protected files via /./ in the URL.
https://www.cve.org/CVERecord?id=CVE-2002-0112

File Processing

File or Directory

/./ (single dot directory)

SFP16
Path Traversal

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Observed_Examples, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Potential_Mitigations

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Observed_Examples

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Observed_Examples, Weakness_Ordinalities

Path Issue - Single Dot Directory - /./