CWE-57
Path Equivalence: 'fakedir/../realdir/filename'
The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.
Impactr finds and proves whether CWE-57 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.