CWE-67
Improper Handling of Windows Device Names
The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
Impactr finds and proves whether CWE-67 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.