CWE-37 is the Unix flavor of absolute path traversal. The product accepts input in the form of a slash absolute path, /absolute/pathname/here, without appropriate validation. An attacker can then reach unintended places in the file system or open arbitrary files.
It is closely related to CWE-36, which is the general absolute path case. CWE-37 names the specific input form: a leading forward slash. Any code that takes a filename or path from outside and hands it to a file API can be affected. MITRE marks it as not language specific.
How it happens
A developer expects a short relative name and builds a path from a trusted base directory plus that name. The code never asks whether the name begins with a slash. If the file API honors absolute paths, the base directory no longer matters.
The record's examples are all older, which says something about how basic the mistake is. Multiple FTP clients wrote arbitrary files via absolute paths in server responses (CVE-2002-1345). A ZIP file extractor allowed full paths (CVE-2001-1269). Two more entries, CVE-2002-1818 and CVE-2002-1913, are listed simply as path traversal using an absolute pathname.
Notice the pattern. In the FTP client case the dangerous input came from a server, not a user. Anything that crosses a trust boundary can carry a path, including archive entries, API responses and message attachments.
// Vulnerable: Express handler trusts the name
const path = require("path");
app.get("/files", (req, res) => {
res.sendFile(path.join("/srv/app/public", req.query.name));
});
In Node, path.join concatenates, so a leading slash gets folded into the base and the result stays under it. That makes path.resolve the riskier call, because it treats an absolute argument as the new root. Either way, the safe move is the same: do not trust the string, check the result.
What an attacker gains
MITRE lists confidentiality and integrity impact: the attacker can read files and modify files or directories. In practice that means reading configuration files with secrets or overwriting files the process can write to.
How to find it
MITRE lists automated static analysis, which can model data flow from external input to file operations. Beyond that, grep for file open, read, write and delete calls and trace each path argument back to its source. Test each endpoint that accepts a filename with a leading slash form in a safe test environment.
How to fix it
Use an allowlist of known good names or a strict character set that excludes directory separators. Reject absolute paths outright. Then resolve the final path and confirm it stays inside the intended directory.
// Fixed: resolve and confirm containment
const path = require("path");
const BASE = path.resolve("/srv/app/public");
app.get("/files", (req, res) => {
const target = path.resolve(BASE, String(req.query.name));
if (!target.startsWith(BASE + path.sep)) return res.sendStatus(400);
res.sendFile(target);
});
Where possible, avoid filenames from users entirely and look files up by an ID you control. If a library you depend on handles paths for you, keep it current. The free dependency scan at gold.safeguard.sh/scan runs in your browser with no login, and the file stays on your machine.
Quick check
What separates CWE-37 from CWE-38?
The input form. CWE-37 is a forward slash absolute path. CWE-38 is a backslash absolute path, which is relevant to Windows style paths.
Where can the dangerous path come from besides a user?
Anything outside your trust boundary. The record includes FTP clients writing files named by a server, and a ZIP extractor trusting entry names.
