CWE-177
AllowedImproper Handling of URL Encoding (Hex Encoding)
Abstraction: Variant · Status: Draft
The product does not properly handle when all or part of an input has been URL encoded.
28 vulnerabilities reference this CWE, most recent first.
GHSA-HCJR-322H-429R
Vulnerability from github – Published: 2026-07-14 09:31 – Updated: 2026-07-14 15:32Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
{
"affected": [],
"aliases": [
"CVE-2026-59083"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T09:16:41Z",
"severity": "CRITICAL"
},
"details": "Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\u0027s rewrite valve allowed security constraint bypass for some configurations.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.",
"id": "GHSA-hcjr-322h-429r",
"modified": "2026-07-14T15:32:15Z",
"published": "2026-07-14T09:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/14/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M75H-X6Q6-7QG6
Vulnerability from github – Published: 2024-12-06 18:30 – Updated: 2025-09-23 15:31An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to run the system into unexpected state.
We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.2.2952 build 20241116 and later
{
"affected": [],
"aliases": [
"CVE-2024-48866"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-06T17:15:08Z",
"severity": "LOW"
},
"details": "An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to run the system into unexpected state.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.9.2954 build 20241120 and later\nQTS 5.2.2.2950 build 20241114 and later\nQuTS hero h5.1.9.2954 build 20241120 and later\nQuTS hero h5.2.2.2952 build 20241116 and later",
"id": "GHSA-m75h-x6q6-7qg6",
"modified": "2025-09-23T15:31:06Z",
"published": "2024-12-06T18:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48866"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en/security-advisory/qsa-24-49"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-P87C-HMGX-WG42
Vulnerability from github – Published: 2026-07-13 12:35 – Updated: 2026-07-13 18:30URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.
This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.
Users are recommended to upgrade to version 1.2.1, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2026-41041"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-13T10:16:28Z",
"severity": "CRITICAL"
},
"details": "URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.\n\nThis issue affects Apache Gravitino: from 1.0.0 before 1.2.1.\n\nUsers are recommended to upgrade to version 1.2.1, which fixes the issue.",
"id": "GHSA-p87c-hmgx-wg42",
"modified": "2026-07-13T18:30:44Z",
"published": "2026-07-13T12:35:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41041"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/4dnwg1qzb2yns1fkfmq0z45vmwyzytgz"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/13/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5QW-H33P-QVWR
Vulnerability from github – Published: 2026-03-04 19:48 – Updated: 2026-03-05 15:26Summary
When using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization.
The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path.
Details
The routing layer preserved %2F as a literal string, while serveStatic decoded it into / before resolving the file path.
Example:
Request: /admin%2Fsecret.html
- Router sees:
/admin%2Fsecret.html→ does not match/admin/* - Static handler resolves:
/admin/secret.html
As a result, static files under the configured static root could be served without triggering route-based protections.
This only affects applications that both:
- Protect subpaths using route-based middleware, and
- Serve files from the same static root using
serveStatic.
This does not allow access outside the static root and is not a path traversal vulnerability.
Impact
An unauthenticated attacker could bypass route-based authorization for protected static resources by supplying paths containing encoded slashes.
Applications relying solely on route-based middleware to protect static subpaths may have exposed those resources.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "hono"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.12.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-29045"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-04T19:48:00Z",
"nvd_published_at": "2026-03-04T23:16:10Z",
"severity": "HIGH"
},
"details": "## Summary\n\nWhen using `serveStatic` together with route-based middleware protections (e.g. `app.use(\u0027/admin/*\u0027, ...)`), inconsistent URL decoding allowed protected static resources to be accessed without authorization.\n\nThe router used `decodeURI`, while `serveStatic` used `decodeURIComponent`. This mismatch allowed paths containing encoded slashes (`%2F`) to bypass middleware protections while still resolving to the intended filesystem path.\n\n\n## Details\n\nThe routing layer preserved `%2F` as a literal string, while `serveStatic` decoded it into `/` before resolving the file path.\n\nExample:\n\nRequest: `/admin%2Fsecret.html`\n\n- Router sees: `/admin%2Fsecret.html` \u2192 does not match `/admin/*`\n- Static handler resolves: `/admin/secret.html`\n\nAs a result, static files under the configured static root could be served without triggering route-based protections.\n\nThis only affects applications that both:\n\n- Protect subpaths using route-based middleware, and\n- Serve files from the same static root using `serveStatic`.\n\nThis does **not** allow access outside the static root and is **not** a path traversal vulnerability.\n\n\n## Impact\n\nAn unauthenticated attacker could bypass route-based authorization for protected static resources by supplying paths containing encoded slashes.\n\nApplications relying solely on route-based middleware to protect static subpaths may have exposed those resources.",
"id": "GHSA-q5qw-h33p-qvwr",
"modified": "2026-03-05T15:26:34Z",
"published": "2026-03-04T19:48:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29045"
},
{
"type": "WEB",
"url": "https://github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3"
},
{
"type": "PACKAGE",
"url": "https://github.com/honojs/hono"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Hono vulnerable to arbitrary file access via serveStatic vulnerability "
}
GHSA-RM99-52XQ-2R9W
Vulnerability from github – Published: 2023-03-07 00:30 – Updated: 2023-03-13 21:30A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
{
"affected": [],
"aliases": [
"CVE-2022-3854"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-06T23:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.",
"id": "GHSA-rm99-52xq-2r9w",
"modified": "2023-03-13T21:30:39Z",
"published": "2023-03-07T00:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3854"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139925"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RRG5-RJGQ-P223
Vulnerability from github – Published: 2024-11-12 00:30 – Updated: 2024-11-12 00:30Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.
{
"affected": [],
"aliases": [
"CVE-2024-23983"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-11T23:15:05Z",
"severity": "MODERATE"
},
"details": "Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.",
"id": "GHSA-rrg5-rjgq-p223",
"modified": "2024-11-12T00:30:36Z",
"published": "2024-11-12T00:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23983"
},
{
"type": "WEB",
"url": "https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html"
},
{
"type": "WEB",
"url": "https://www.pingidentity.com/en/resources/downloads/pingaccess.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:M/U:Amber",
"type": "CVSS_V4"
}
]
}
GHSA-WM77-Q74P-5763
Vulnerability from github – Published: 2018-07-27 17:06 – Updated: 2021-08-09 22:21Affected of superstatic are vulnerable to path traversal when used on Windows.
Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \\ to / in paths on all platforms (a known example being Node.js v9.9.0).
Recommendation
Update to version 5.0.2 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "superstatic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T22:00:48Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected of `superstatic` are vulnerable to path traversal when used on Windows. \n\nAdditionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).\n\n\n## Recommendation\n\nUpdate to version 5.0.2 or later.",
"id": "GHSA-wm77-q74p-5763",
"modified": "2021-08-09T22:21:02Z",
"published": "2018-07-27T17:06:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/firebase/superstatic/pull/255"
},
{
"type": "WEB",
"url": "https://github.com/firebase/superstatic/commit/e396ff62f588732989137d6c40d46b310e51ef2b"
},
{
"type": "WEB",
"url": "https://github.com/firebase/superstatic/blob/v5.0.1/lib/providers/fs.js#L71"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/652"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Path Traversal in superstatic"
}
GHSA-X428-GHPX-8J92
Vulnerability from github – Published: 2026-04-16 22:34 – Updated: 2026-04-16 22:34Impact
@fastify/static v9.1.0 and earlier decodes percent-encoded path separators (%2F) before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/* do not match /admin%2Fsecret.html, but @fastify/static decodes it to /admin/secret.html and serves the file.
Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with encoded path separators.
Patches
Upgrade to @fastify/static >= 9.1.1.
Workarounds
None. Upgrade to the patched version.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.1.0"
},
"package": {
"ecosystem": "npm",
"name": "@fastify/static"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "9.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6414"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T22:34:03Z",
"nvd_published_at": "2026-04-16T13:16:52Z",
"severity": "MODERATE"
},
"details": "### Impact\n\n`@fastify/static` v9.1.0 and earlier decodes percent-encoded path separators (`%2F`) before filesystem resolution, but Fastify\u0027s router treats them as literal characters. This creates a routing mismatch: route guards on `/admin/*` do not match `/admin%2Fsecret.html`, but @fastify/static decodes it to `/admin/secret.html` and serves the file.\n\nApplications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with encoded path separators.\n\n### Patches\n\nUpgrade to `@fastify/static` \u003e= 9.1.1.\n\n### Workarounds\n\nNone. Upgrade to the patched version.",
"id": "GHSA-x428-ghpx-8j92",
"modified": "2026-04-16T22:34:03Z",
"published": "2026-04-16T22:34:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92"
},
{
"type": "WEB",
"url": "https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p"
},
{
"type": "WEB",
"url": "https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6414"
},
{
"type": "WEB",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/fastify/fastify-static"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "@fastify/static vulnerable to route guard bypass via encoded path separators"
}
Mitigation MIT-44
Strategy: Input Validation
Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CAPEC-120: Double Encoding
The adversary utilizes a repeating of the encoding process for a set of characters (that is, character encoding a character encoding of a character) to obfuscate the payload of a particular request. This may allow the adversary to bypass filters that attempt to detect illegal characters or strings, such as those that might be used in traversal or injection attacks. Filters may be able to catch illegal encoded strings, but may not catch doubly encoded strings. For example, a dot (.), often used in path traversal attacks and therefore often blocked by filters, could be URL encoded as %2E. However, many filters recognize this encoding and would still block the request. In a double encoding, the % in the above URL encoding would be encoded again as %25, resulting in %252E which some filters might not catch, but which could still be interpreted as a dot (.) by interpreters on the target.
CAPEC-468: Generic Cross-Browser Cross-Domain Theft
An attacker makes use of Cascading Style Sheets (CSS) injection to steal data cross domain from the victim's browser. The attack works by abusing the standards relating to loading of CSS: 1. Send cookies on any load of CSS (including cross-domain) 2. When parsing returned CSS ignore all data that does not make sense before a valid CSS descriptor is found by the CSS parser.
CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic
This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
CAPEC-72: URL Encoding
This attack targets the encoding of the URL. An adversary can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL.