{
    "ok": true,
    "catalog": {
        "name": "CWE",
        "version": "4.20",
        "date": "2026-04-30",
        "notice": "CWE content © 2026 The MITRE Corporation (https://cwe.mitre.org), used under the CWE Terms of Use. CWE is a trademark of The MITRE Corporation."
    },
    "query": "path traversal in zip extraction",
    "results": [
        {
            "id": "CWE-37",
            "name": "Path Traversal: '/absolute/pathname/here'",
            "kind": "weakness",
            "abstraction": "Variant",
            "status": "Draft",
            "usage": "Allowed",
            "description": "The product accepts input in the form of a slash absolute path ('/absolute/pathname/here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.",
            "url": "https://cwe.mitre.org/data/definitions/37.html"
        },
        {
            "id": "CWE-23",
            "name": "Relative Path Traversal",
            "kind": "weakness",
            "abstraction": "Base",
            "status": "Draft",
            "usage": "Allowed",
            "description": "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as \"..\" that can resolve to a location that is outside of that directory.",
            "url": "https://cwe.mitre.org/data/definitions/23.html"
        },
        {
            "id": "CWE-22",
            "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
            "kind": "weakness",
            "abstraction": "Base",
            "status": "Stable",
            "usage": "Allowed-with-Review",
            "description": "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.",
            "url": "https://cwe.mitre.org/data/definitions/22.html"
        },
        {
            "id": "CWE-36",
            "name": "Absolute Path Traversal",
            "kind": "weakness",
            "abstraction": "Base",
            "status": "Draft",
            "usage": "Allowed",
            "description": "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as \"/abs/path\" that can resolve to a location that is outside of that directory.",
            "url": "https://cwe.mitre.org/data/definitions/36.html"
        },
        {
            "id": "CWE-346",
            "name": "Origin Validation Error",
            "kind": "weakness",
            "abstraction": "Class",
            "status": "Draft",
            "usage": "Allowed-with-Review",
            "description": "The product does not properly verify that the source of data or communication is valid.",
            "url": "https://cwe.mitre.org/data/definitions/346.html"
        },
        {
            "id": "CWE-914",
            "name": "Improper Control of Dynamically-Identified Variables",
            "kind": "weakness",
            "abstraction": "Base",
            "status": "Incomplete",
            "usage": "Allowed",
            "description": "The product does not properly restrict reading from or writing to dynamically-identified variables.",
            "url": "https://cwe.mitre.org/data/definitions/914.html"
        },
        {
            "id": "CWE-621",
            "name": "Variable Extraction Error",
            "kind": "weakness",
            "abstraction": "Variant",
            "status": "Incomplete",
            "usage": "Allowed",
            "description": "The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.",
            "url": "https://cwe.mitre.org/data/definitions/621.html"
        },
        {
            "id": "CWE-50",
            "name": "Path Equivalence: '//multiple/leading/slash'",
            "kind": "weakness",
            "abstraction": "Variant",
            "status": "Incomplete",
            "usage": "Allowed",
            "description": "The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.",
            "url": "https://cwe.mitre.org/data/definitions/50.html"
        },
        {
            "id": "CWE-26",
            "name": "Path Traversal: '/dir/../filename'",
            "kind": "weakness",
            "abstraction": "Variant",
            "status": "Draft",
            "usage": "Allowed",
            "description": "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize \"/dir/../filename\" sequences that can resolve to a location that is outside of that directory.",
            "url": "https://cwe.mitre.org/data/definitions/26.html"
        },
        {
            "id": "CWE-25",
            "name": "Path Traversal: '/../filedir'",
            "kind": "weakness",
            "abstraction": "Variant",
            "status": "Incomplete",
            "usage": "Allowed",
            "description": "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize \"/../\" sequences that can resolve to a location that is outside of that directory.",
            "url": "https://cwe.mitre.org/data/definitions/25.html"
        }
    ]
}