The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
Be familiar with the device names in the operating system where your system is deployed. Check input for these device names.
Our security experts can help you identify and remediate CWE-67 vulnerabilities in your codebase.
Get Security Assessment