CWE-175 is the failure to handle input where the same value uses several different encodings at once. A path might have a plain slash, a percent encoded dot and an escaped letter in the same string.
Any component that validates names or paths and handles only one encoding at a time is exposed. That includes filters, routers and file handlers.
How it happens
A validator is written with one encoding in mind. It decodes or compares in that single form. A mixed input has parts in other forms, which survive the check unchanged and are resolved later by a component that knows more encodings than the validator did.
The record lists no observed example CVEs for this entry. For related real cases in decoding, see CWE-172 and CWE-174.
What an attacker gains
MITRE lists integrity impact as unexpected state. In practice, filter and access check bypass is what mixed encodings are used for.
How to find it
No detection methods are listed. Send values that blend plain characters, percent encoding and other escapes for the same sensitive characters, and check what the final consumer receives.
How to fix it
- Avoid making decisions based on names of resources if those resources can have alternate names.
- Assume all input is malicious. Accept known good values only, and reject or transform the rest.
- Convert the input to one canonical internal form first, decoding exactly once, and validate that form.
- Reject values that still contain encoded sequences after decoding when none are expected.
Quick check
How is mixed encoding different from double decoding?
Double decoding decodes the same data twice. Mixed encoding means one value contains several encodings side by side. The fix for both is one canonical form, checked once.
