CWE-243
Creation of chroot Jail Without Changing Working Directory
The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
Impactr finds and proves whether CWE-243 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.