CWE-40 is about input that identifies a Windows UNC share, written like \\UNC\share\name. When a product accepts that without validation, access can be redirected to an unintended location or arbitrary file.
A UNC path points at a resource on a network host. If your code opens whatever path it is handed, an attacker can steer it at a share instead of a local folder. MITRE lists Windows among the platforms, alongside not language specific and not technology specific.
How it happens
Validation was written to keep paths under a local base directory. It checks for dot dot and a leading slash, but not for a double backslash prefix. The record has one example: an FTP server allowed a remote attacker to retrieve privileged web server system information by specifying arbitrary paths in the UNC format, \\computername\sharename (CVE-2001-0687).
What an attacker gains
MITRE lists read and modify access to files and directories, so both confidentiality and integrity are in scope.
How to find it
Static analysis can trace external input to file operations. Add a test with a UNC form for every Windows facing endpoint that takes a path.
How to fix it
Use a strict allowlist for names. Reject any value that contains a backslash, a colon or begins with two separators. Then resolve the path and check it stays under your base directory.
// Reject UNC and rooted input, then check containment
var baseDir = Path.GetFullPath(@"C:\data\exports") + Path.DirectorySeparatorChar;
if (name.StartsWith(@"\\") || Path.IsPathRooted(name)) throw new ArgumentException();
var full = Path.GetFullPath(Path.Combine(baseDir, name));
if (!full.StartsWith(baseDir, StringComparison.OrdinalIgnoreCase)) throw new ArgumentException();
Where outbound network access from the host is not needed, block it so a UNC path cannot reach anywhere useful.
Quick check
How is a UNC path different from a local path?
It names a network host and share, like double backslash computername backslash sharename, so access can leave the machine and the intended directory.
