CWE-66
Improper Handling of File Names that Identify Virtual Resources
The product does not handle or incorrectly handles a file name that identifies a virtual resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file.
Impactr finds and proves whether CWE-66 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.