CWE-45 covers path input with multiple internal dots, like file...dir, accepted without appropriate validation. MITRE says this can lead to ambiguous path resolution and let an attacker reach unintended locations or files.
It is a close relative of CWE-44, the single internal dot, and of the general class CWE-41. The record lists no observed CVEs for it, so this is a weakness to know about when reviewing filename handling rather than one with a long exploit history.
How it happens
Runs of dots look unusual, so many validators only check for the well known .. sequence and nothing else. If the platform or a downstream library collapses, strips or reinterprets dot runs, the name that was checked is not the name that gets opened. It is the usual path equivalence gap: validation and use disagree.
What an attacker gains
MITRE lists reading and modifying files and directories, so confidentiality and integrity are in scope.
How to find it
The record gives no specific detection technique. Reasonable checks are code review of filename validators and tests that submit names with runs of dots to each file handling endpoint in a staging environment.
How to fix it
- Accept filenames only from a strict allowlist of characters, and if feasible allow a single dot, as MITRE suggests for filenames.
- Canonicalize before comparing or applying access rules.
- Generate storage names yourself instead of reusing user input.
import re
NAME = re.compile(r"^[A-Za-z0-9_]{1,64}\.[A-Za-z0-9]{1,8}$")
if not NAME.fullmatch(name):
raise ValueError("bad filename")
The free dependency scan at gold.safeguard.sh/scan can help you keep file handling libraries current.
Quick check
Why check more than dot dot?
Other dot runs can be reinterpreted by the platform or a later layer, so the validated string may not match the opened file. An allowlist avoids guessing which forms are dangerous.
