The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
Do not allow users to control names of resources used on the server side.
Perform allowlist input validation at entry points and also before consuming the resources. Reject bad file names rather than trying to cleanse them.
Make sure that technologies consuming the resources are not vulnerable (e.g. buffer overflow, format string, etc.) in a way that would allow code execution if the name of the resource is malformed.
Our security experts can help you identify and remediate CWE-641 vulnerabilities in your codebase.
Get Security Assessment