What is External Control of File Name or Path (CWE-73)?

TL;DR: External Control of File Name or Path (CWE-73) is a vulnerability that occurs when user input influences paths or file names used in filesystem operations, potentially leading to unauthorized access or modifications. To fix this vulnerability, use path canonicalization.

At-a-Glance

What is External Control of File Name or Path?

External control of file name or path (CWE-73) is a type of vulnerability that occurs when a user’s input influences paths or file names used in filesystem operations, potentially leading to unauthorized access or modifications. As defined by the MITRE Corporation under CWE-73, and classified by the OWASP Foundation under A06:2025 - Insecure Design…

Quick Summary

External control of file name or path (CWE-73) is a critical vulnerability that can lead to data breaches, system compromise, and financial loss. It occurs when user input influences paths or file names used in filesystem operations, potentially leading to unauthorized access or modifications.

Jump to: Quick Summary · External Control of File Name or Path Overview · How External Control of File Name or Path Works · Business Impact of External Control of File Name or Path · External Control of File Name or Path Attack Scenario · How to Detect External Control of File Name or Path · How to Fix External Control of File Name or Path · Framework-Specific Fixes for External Control of File Name or Path · How to Ask AI to Check Your Code for External Control of File Name or Path · External Control of File Name or Path Best Practices Checklist · External Control of File Name or Path FAQ · Vulnerabilities Related to External Control of File Name or Path · References

External Control of File Name or Path Overview

What: External control of file name or path (CWE-73) occurs when a user’s input influences paths or file names used in filesystem operations, potentially leading to unauthorized access or modifications.

Why it matters: This vulnerability can lead to data breaches, system compromise, and financial loss. It is essential to prevent External Control of File Name or Path by following secure coding practices, using input validation, and implementing path canonicalization.

Where it occurs: External control of file name or path (CWE-73) can occur in any application that uses user input to construct paths or file names.

Who is affected: Any application that uses user input to construct paths or file names is potentially vulnerable to External Control of File Name or Path.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not vulnerable to External Control of File Name or Path.

How External Control of File Name or Path Works

Root Cause

External control of file name or path (CWE-73) occurs when a user’s input influences paths or file names used in filesystem operations, potentially leading to unauthorized access or modifications.

Attack Flow

1. The attacker provides malicious input to the application.
2. The application uses the malicious input to construct a path or file name.
3. The constructed path or file name is used to access or modify sensitive data.

Prerequisites to Exploit

• The application must use user input to construct paths or file names.
• The application must not validate or sanitize the user input.

Vulnerable Code

$path = $_GET['path'];
if (file_exists($path)) {
    include $path;
}

This code is vulnerable because it uses user input to construct a path without validation or sanitization.

Secure Code

$path = realpath($_GET['path']);
if (file_exists($path)) {
    include $path;
}

This code is secure because it uses the realpath() function to normalize the path and prevent external control of file names or paths.

Business Impact of External Control of File Name or Path

Confidentiality: Unauthorized access to sensitive data can lead to data breaches, compromising confidentiality.

Integrity: Unauthorized modifications to sensitive data can lead to system compromise, compromising integrity.

Availability: Denial-of-service (DoS) attacks can disrupt system availability.

External Control of File Name or Path Attack Scenario

1. The attacker provides malicious input to the application.
2. The application uses the malicious input to construct a path or file name.
3. The constructed path or file name is used to access or modify sensitive data.

How to Detect External Control of File Name or Path

Manual Testing

• Use manual testing to identify potential vulnerabilities in your application’s code.
• Review the code for any instances where user input is used to construct paths or file names without validation or sanitization.

Automated Scanners (SAST / DAST)

• Use automated scanners to detect potential vulnerabilities in your application’s code.
• Note that static analysis may not catch all instances of External Control of File Name or Path, as some cases may require dynamic/runtime testing.

PenScan Detection

• PenScan’s scanner engines can detect potential instances of External Control of File Name or Path in your application’s code.

False Positive Guidance

• Be aware that false positives may occur when the pattern looks risky but is actually safe due to context a scanner cannot see.
• Review any detected vulnerabilities carefully and verify their validity before taking corrective action.

How to Fix External Control of File Name or Path

• Use path canonicalization to normalize file paths and prevent external control of file names or paths.
• Validate and sanitize user input to prevent malicious input from influencing paths or file names.
• Implement secure coding practices to prevent vulnerabilities in your application’s code.

Framework-Specific Fixes for External Control of File Name or Path

PHP

$path = realpath($_GET['path']);
if (file_exists($path)) {
    include $path;
}

This code uses the realpath() function to normalize the path and prevent external control of file names or paths.

Java

String path = new String(URI.create(request.getParameter("path")).getPath());
File file = new File(path);
if (file.exists()) {
    include(file.getAbsolutePath());
}

This code uses the URI class to normalize the path and prevent external control of file names or paths.

Python/Django

from django.http import HttpResponse
from urllib.parse import unquote

path = unquote(request.GET.get('path'))
file_path = os.path.abspath(path)
if os.path.exists(file_path):
    return HttpResponse(open(file_path, 'rb').read())

This code uses the unquote() function to normalize the path and prevent external control of file names or paths.

Node.js

const express = require('express');
const fs = require('fs');

app.get('/path', (req, res) => {
  const path = req.query.path;
  const filePath = path.replace(/^\/+/, '');
  if (fs.existsSync(filePath)) {
    res.sendFile(filePath);
  } else {
    res.status(404).send('Not Found');
  }
});

This code uses the replace() method to normalize the path and prevent external control of file names or paths.

How to Ask AI to Check Your Code for External Control of File Name or Path

Use a copy-pasteable prompt with an AI coding assistant, such as “Review the following [language] code block for potential CWE-73 External Control of File Name or Path vulnerabilities and rewrite it using path canonicalization.”

External Control of File Name or Path Best Practices Checklist

✅ Use path canonicalization to normalize file paths and prevent external control of file names or paths. ✅ Validate and sanitize user input to prevent malicious input from influencing paths or file names. ✅ Implement secure coding practices to prevent vulnerabilities in your application’s code.

External Control of File Name or Path FAQ

How does External Control of File Name or Path occur?

External control of file name or path occurs when a user’s input influences paths or file names used in filesystem operations, potentially leading to unauthorized access or modifications.

What are the common consequences of External Control of File Name or Path?

The common consequences include reading files or directories, modifying files or directories, executing unauthorized code or commands, and denial-of-service (DoS) attacks.

How can I detect External Control of File Name or Path in my application?

You can detect External Control of File Name or Path by using manual testing, automated scanners (SAST / DAST), and PenScan’s detection capabilities.

What are the potential mitigations for External Control of File Name or Path?

The potential mitigations include input validation, path canonicalization, OS-level permissions, and secure coding practices.

How can I prevent External Control of File Name or Path in my application?

You can prevent External Control of File Name or Path by following secure coding practices, using input validation, and implementing path canonicalization.

What are the related weaknesses to External Control of File Name or Path?

The related weaknesses include CWE-642 (External Control of Critical State Data), CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), and CWE-20 (Improper Input Validation).

How can I ask AI to check my code for External Control of File Name or Path?

You can use a copy-pasteable prompt with an AI coding assistant, such as “Review the following [language] code block for potential CWE-73 External Control of File Name or Path vulnerabilities and rewrite it using path canonicalization.”

Vulnerabilities Related to External Control of File Name or Path

References

• MITRE CWE-73
• OWASP A06:2025 - Insecure Design
• CAPEC-13, CAPEC-267, CAPEC-64, CAPEC-72, CAPEC-76, CAPEC-78, CAPEC-79, CAPEC-80
• NVD CVE Database

Scan Your Own Site

Scan your website free using PenScan’s automated scanning engine.