Common Weakness Enumeration

    CWE Definition / CWE-99

    CWE-99: Improper Control of Resource Identifiers ('Resource Injection')

    The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

    Published:19 Jul 2006
    Organization:MITRE
    Modified:11 Dec 2025

    Related Weakness

    CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    CWE-706: Use of Incorrectly-Resolved Name or Reference

    CWE-73: External Control of File Name or Path