CWE-56 is path equivalence using a wildcard, filedir*. The product accepts path input with an asterisk without appropriate validation, so path resolution becomes ambiguous and an attacker may reach unintended files or directories.
It is a member of the family under CWE-41. It matters wherever a server or library expands wildcards before or after applying an access rule.
How it happens
Some components treat * as a pattern, not a literal character. If a rule says the directory is not listable, but a request with a wildcard reaches code that expands the pattern, the result is a listing. The record has two examples: listing directories using a desired path and * (CVE-2004-0696), and listing files in a web server using *.ext (CVE-2002-0433).
What an attacker gains
MITRE lists reading and modifying files and directories. Listings reveal names that make later attacks easier.
How to find it
In a staging environment, append * and *.ext to directory paths and see whether an index is returned. Search your code for glob, wildcard and pattern expansion that takes input from a request.
How to fix it
- Treat wildcard characters as invalid in filenames and reject them.
- Disable directory listing where it is not required.
- Never pass request values to glob or shell expansion.
if any(c in name for c in "*?[]"):
raise ValueError("wildcards not allowed")
Keep servers current. The free scan at gold.safeguard.sh/scan needs no login.
Quick check
Why is a wildcard dangerous in a path?
Some components expand it into a set of matches, which turns a request for one thing into a listing of many.
