CWE-69

Improper Handling of Windows ::DATA Alternate Data Stream

VariantIncomplete

Description

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.

Hierarchy (View 1000)

Parents

CWE-66

Children

none

Related attack patterns (CAPEC)

CAPEC-168

CVEs mapped to this weakness (3)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2024-43033	Jpress jpress	Hig	0.57	8.8	0.01	Aug 22, 2024	JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the…
CVE-2026-52792	Xyproto Algernon	Hig	0.50	—	0.01	Aug 19, 2026	Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client…
CVE-2025-3941	Tridium Niagara Enterprise Security	Med	0.35	5.4	0.01	May 22, 2025	Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11;…

CVE-2024-43033HigAug 22, 2024
Jpress
jpress
risk 0.57cvss 8.8epss 0.01
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the…
CVE-2026-52792HigAug 19, 2026
Xyproto
Algernon
risk 0.50cvss —epss 0.01
Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client…
CVE-2025-3941MedMay 22, 2025
Tridium
Niagara Enterprise Security
risk 0.35cvss 5.4epss 0.01
Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11;…