CWE-160 is the failure to neutralize leading special elements, the characters at the start of a value that a downstream component reads in an unexpected way. The classic case is a leading slash that turns a relative file name into an absolute path.
File handling code is the main place it shows up, in downloaders, archive extractors and upload handlers. Clients that trust file names sent by a server are a notable group.
How it happens
The record's only observed example is CVE-2002-1345, where multiple FTP clients write arbitrary files via absolute paths in server responses. The client expected a plain name. The server sent a name that started with a slash.
Joining paths makes the mistake easy in many languages.
import os
# Vulnerable: an absolute name discards the destination directory
dest = os.path.join("/downloads", remote_name)
open(dest, "wb").write(data)
In Python, os.path.join("/downloads", "/etc/cron.d/job") returns the second argument alone. The leading slash wins.
What an attacker gains
MITRE lists integrity impact as unexpected state. The observed example is arbitrary file writes, which can overwrite configuration or startup files the user owns.
How to find it
MITRE lists no detection methods. Review any code that joins a base directory with a name from outside. Test with names starting with a slash, a backslash, a drive letter or a dot. Check clients as well as servers.
How to fix it
- Anticipate that leading special elements will be injected, removed or manipulated.
- Reduce the name to its final component, then confirm that the resolved path is inside the intended directory.
import os
base = os.path.realpath("/downloads")
name = os.path.basename(remote_name)
dest = os.path.realpath(os.path.join(base, name))
if os.path.commonpath([base, dest]) != base:
raise ValueError("path escapes download directory")
- Prefer an allowlist of characters for names and reject anything else.
- Do not trust names sent by a remote party just because it is a server you chose.
Quick check
Do only servers need this check?
No. CVE-2002-1345 affected FTP clients that wrote files based on server responses.
