CWE-42— Path Equivalence: 'filename.' (Trailing Dot)

The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.— MITRE CWE catalog

2 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-42page 1 of 1

• CVE-2026-52884HIGHCVSS 7.8EG 7.8

  2026-06-26

  Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with truste…

• CVE-2021-21682MEDIUMCVSS 4.3EG 6.3

  2021-10-06

  Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.