CWE-706, Use of Incorrectly-Resolved Name or Reference, covers products that use a name or reference to reach a resource, where the name resolves to something outside the intended control sphere. It is a class level entry, not language or technology specific, and it sits above many familiar bugs.
How it happens
Names are indirections. A file path, a symbolic link, a hostname or an alias gets resolved by the system at the moment of use. If the program assumes the name points inside its own area, but resolution lands elsewhere, the program acts on a resource it was never meant to touch.
The MITRE record lists no observed CVEs for this umbrella. Specific children cover the details, such as path traversal and link following.
An illustration with a file path:
# Vulnerable: the joined path may resolve outside BASE_DIR
path = os.path.join(BASE_DIR, user_supplied_name)
return open(path).read()
Names like ../../etc/passwd or a symbolic link planted inside the directory both resolve outside the intended area.
What an attacker gains
MITRE lists reading and modifying application data, so confidentiality and integrity.
How to find it
MITRE notes static analysis can find some instances by modelling data flow, tracing outside input into name based lookups. Review every place a user controlled string becomes a path, URL, identifier or class name.
How to fix it
The record has no mitigation text. A reliable approach is to resolve first, then check:
# Fixed: resolve, then confirm the result is inside the allowed area
base = os.path.realpath(BASE_DIR)
path = os.path.realpath(os.path.join(base, user_supplied_name))
if os.path.commonpath([base, path]) != base:
raise PermissionError("outside base directory")
return open(path).read()
Better still, map external values to internal ones, such as an ID to a stored file, so users never supply names directly.
Quick check
Why check after resolving instead of before?
Because the check must apply to where the name actually ends up, after links and relative parts are resolved.
