CWE-249: DEPRECATED: Often Misused: Path Manipulation

Extended Description

This entry was deprecated for several reasons. The primary reason is over-loading of the "path manipulation" term and the description. The original description for this entry was the same as that for the "Often Misused: File System" item in the original Seven Pernicious Kingdoms paper. However, Seven Pernicious Kingdoms also has a "Path Manipulation" phrase that is for external control of pathnames (CWE-73), which is a factor in symbolic link following and path traversal, neither of which is explicitly mentioned in 7PK. Fortify uses the phrase "Often Misused: Path Manipulation" for a broader range of problems, generally for issues related to buffer management. Given the multiple conflicting uses of this term, there is a chance that CWE users may have incorrectly mapped to this entry. The second reason for deprecation is an implied combination of multiple weaknesses within buffer-handling functions. The focus of this entry was generally on the path-conversion functions and their association with buffer overflows. However, some of Fortify's Vulncat entries have the term "path manipulation" but describe a non-overflow weakness in which the buffer is not guaranteed to contain the entire pathname, i.e., there is information truncation (see CWE-222 for a similar concept). A new entry for this non-overflow weakness may be created in a future version of CWE.

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Detect imprecise mappings involving CWE-249

Review mappings to CWE-249, DEPRECATED: Often Misused: Path Manipulation, with MITRE's mapping and navigation criteria. Flag any selection that points to a View or Category, remains at a higher abstraction than the available evidence supports, or ignores relevant parent, child, peer, and alternative entries. Treat those findings as mapping-quality defects, correct them before publication, and retain the comparison trail for repeatable audits.

CWE Mapping and Navigation Guidance — MITRE CWE

Prevent CWE-249 through an SSDF control plan

Use NIST SSDF practices to make prevention of CWE-249, DEPRECATED: Often Misused: Path Manipulation, an explicit development outcome. Translate the CWE definition into security requirements and design constraints, choose safer implementation patterns and toolchain checks, and define acceptance evidence before release. Feed every confirmed occurrence back into the requirements, design review, and coding rules so the same root cause is removed across the product rather than patched in one location.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Preserve historical context for deprecated CWE-249

Treat CWE-249, DEPRECATED: Often Misused: Path Manipulation, as a historical identifier only. When reviewing CISA's Known Exploited Vulnerabilities catalog, preserve this deprecated ID only if an original historical record used it; do not create a new mapping to it. Re-evaluate the vulnerability evidence against active CWE entries, document the replacement and rationale, and use KEV status to prioritize the affected product—not to revive or generalize the deprecated weakness.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Preserve CWE-249 only for deprecated historical mappings

MITRE marks CWE-249 as deprecated and prohibits using it for new vulnerability mappings. This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785. Keep this page for historical lookup, but follow MITRE's replacement guidance and select a current weakness identifier for new findings, metrics, and remediation work.

CWE-249: DEPRECATED: Often Misused: Path Manipulation — MITRE CWE

Validate CWE-249 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-249, DEPRECATED: Often Misused: Path Manipulation. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-249: DEPRECATED: Often Misused: Path Manipulation?+

CWE-249: DEPRECATED: Often Misused: Path Manipulation is a Common Weakness Enumeration (CWE) entry maintained by MITRE. This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785. This entry was deprecated for several reasons. The primary reason is over-loading of the "path manipulation" term and the description. The original description for this entry was the same as that for the "Often Misused: File System" item in the original Seven Pernicious Kingdoms paper. However, Seven Pernicious Kingdoms also has a "Path Manipulation" phrase that is for external control of pathnames (CWE-73), which is a factor in symbolic link following and path traversal, neither of which is explicitly mentioned in 7PK. Fortify uses the phrase "Often Misused: Path Manipulation" for a broader range of problems, generally for issues related to buffer management. Given the multiple conflicting uses of this term, there is a chance that CWE users may have incorrectly mapped to this entry. The second reason for deprecation is an implied combination of multiple weaknesses within buffer-handling functions. The focus of this entry was generally on the path-conversion functions and their association with buffer overflows. However, some of Fortify's Vulncat entries have the term "path manipulation" but describe a non-overflow weakness in which the buffer is not guaranteed to contain the entire pathname, i.e., there is information truncation (see CWE-222 for a similar concept). A new entry for this non-overflow weakness may be created in a future version of CWE.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-249 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-249: DEPRECATED: Often Misused: Path Manipulation

Extended Description

Technical Details

Applicable To

Security Consequences

Mitigation Strategies

Detection Methods

Code Examples & CVEs

CWE Relationships