CWE-47 is path equivalence with a leading space, as in filedir. The product accepts that input without appropriate validation, which can lead to ambiguous path resolution and let an attacker reach unintended files.
It is part of the family under CWE-41. The record lists no observed CVEs for it, so treat it as a checklist item for code that handles filenames.
How it happens
A comparison is made on the raw string, such as "is this name on the deny list" or "does it start with the protected prefix". A leading space changes the string without changing what some components resolve it to. If a later step trims whitespace or the platform ignores it, the checked name and the opened name differ.
What an attacker gains
MITRE lists reading and modifying files and directories.
How to find it
The record names no detection method. Review validators for whitespace handling, and in a staging environment submit names with leading spaces to each endpoint that takes a path or filename.
How to fix it
Reject names with leading or trailing whitespace, use a character allowlist, and canonicalize before any access decision.
if name != name.strip() or not re.fullmatch(r"[A-Za-z0-9_.]{1,64}", name):
raise ValueError("bad filename")
Keep file handling libraries current. The free scan at gold.safeguard.sh/scan runs in your browser without a login.
Quick check
Why reject whitespace instead of trimming it?
Trimming quietly changes what was validated. Rejecting makes the accepted set small and easy to reason about.
