The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
Volume of CVEs assigned to CWE-647 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-43939CRITICAL Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumven | Apr 3, 2023 | 9.8 | 99 | YES | YES |
CVE-2025-64500HIGH Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP s | Nov 12, 2025 | 7.3 | 39 | NO | YES |
CVE-2026-59731HIGH Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, | Jul 8, 2026 | 8.2 | 35 | NO | NO |
CVE-2026-62685HIGH File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new u | Jul 15, 2026 | 8.1 | 34 | NO | NO |
CVE-2026-5222MEDIUM Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hoste | May 25, 2026 | 6.5 | 32 | NO | NO |
CVE-2026-8384MEDIUM In Eclipse Jetty, an HTTP URI of this form:
/public;/../admin/secret.txt
results in an unresolved path of:
/public/../admin/secret.txt
instead of the expe | Jul 14, 2026 | 5.3 | 30 | NO | NO |
CVE-2025-9909MEDIUM A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using | Feb 27, 2026 | 6.7 | 23 | NO | NO |
CVE-2025-66202MEDIUM Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro | Dec 9, 2025 | 6.5 | 23 | NO | NO |
CVE-2025-47241MEDIUM In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component. | May 3, 2025 | 4.0 | 18 | NO | NO |
Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which is not consistent wi | Apr 21, 2025 | 3.4 | 14 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.