A security scanner reports "CWE-22: Path Traversal". A developer reads it and asks a fair question: so what? The name says what is wrong with the code. It does not say what an attacker can do with it. That gap is why real vulnerabilities sit in backlogs.
So we started from the other end. We read the published security advisories for five popular open-source products: the Gogs git server (Go), the DataEase analytics platform (Java), the Kanboard project board (PHP), the Umbraco CMS (C#) and the Novu notification platform (TypeScript). That is 140 advisories. For each one we asked three questions. What weakness was in the code? What did it let an attacker do? And what does that code look like, so it can be caught before release?
The answer fits on one page. Attackers want about nine things. Each one is reached through a small set of weaknesses.
The map
| What the attacker gets | The weakness behind it (CWE) |
|---|---|
| Runs commands on your server | Command and argument injection (CWE-77, 78, 88), unsafe deserialization (CWE-502), injection into an interpreter or connection string (CWE-74, 94) |
| Reads, overwrites or deletes any file | Path traversal (CWE-22), user-controlled file names (CWE-73), XML external entities (CWE-611) |
| Copies your database | SQL injection (CWE-89) |
| Takes over a logged-in user's session | Cross-site scripting (CWE-79, 80) |
| Acts as another user, or as admin | Missing authorization (CWE-862, 639), privilege escalation (CWE-269), spoofable identity headers (CWE-290), cross-site request forgery (CWE-352), unverified tokens (CWE-347), sessions that outlive logout (CWE-613), poisoned reset links (CWE-640) |
| Reaches your internal network | Server-side request forgery (CWE-918) |
| Phishes your users from your own domain | Open redirect (CWE-601) |
| Steals credentials or guesses passwords | Secrets in URLs (CWE-598), lockouts keyed on spoofable headers (CWE-307) |
| Takes the service offline | Uncontrolled resource use (CWE-400) |
Below, each row with a real CVE that shows it, and the shape of the code to look for.
1. Run commands on your server
This is the worst outcome. The attacker owns the machine: its data, its credentials, and every system it can reach.
Seen in the wildGogs CVE-2026-52806. A user names a branch --exec=<command>. When a pull request is merged, Gogs passes the name to git rebase, and git runs the command. Gogs CVE-2024-39930 is the same idea through its built-in SSH server.
DataEase had seven advisories of one shape (CVE-2025-24974, CVE-2025-46566 and others). A user adds parameters to a database connection URL. The database driver then reads a server file, loads an attacker's class, or fetches remote code.
Kanboard CVE-2025-55010. Stored data is passed to PHP's unserialize(), which can build any object and run its code.
The code to look forUser input reaching a command line, a deserializer, or a driver's configuration. For git and similar tools, a name that can start with - and is not preceded by --.
2. Read, overwrite or delete any file
Reading files exposes keys and passwords. Overwriting them often leads straight back to running code.
Seen in the wildGogs CVE-2026-23633: a git hook named ../../something reads or writes any file. Gogs CVE-2024-56731: deleting internal files leads to remote code execution.
DataEase CVE-2026-55631: a font is stored with a file name that is really a path, so deleting the font deletes that file. DataEase CVE-2024-46985: an uploaded XML file names a server file as an external entity, and the parser reads it into the response.
Kanboard CVE-2024-51747 and Umbraco CVE-2025-66625: a file name from the request is joined to a folder and opened.
The code to look forA path built from user input, with no check that the result stays inside the intended folder. An XML parser with external entities left on.
3. Copy your database
Seen in the wildDataEase CVE-2026-55635, CVE-2026-32137 and others: a value from a chart filter is pasted inside quotes in a SQL string. A quote in the value ends the string and starts the attacker's SQL. DataEase CVE-2026-33083: a sort direction that should be ASC or DESC is accepted as any text.
The code to look forSQL built by joining strings. Column names, table names and sort orders matter as much as values, because query parameters cannot protect them.
4. Take over a logged-in user's session
Cross-site scripting runs the attacker's script inside a victim's browser, with the victim's access. When the victim is an admin, the attacker is too.
Seen in the wildGogs CVE-2026-26022: the HTML sanitizer allowed data: links in comments. DataEase CVE-2026-32139: an SVG upload was checked only at its top element, so script inside it got through. Kanboard CVE-2023-33969: a stored link was printed into the page without escaping. Gogs CVE-2026-26195: a commit author's name was marked as trusted HTML.
The code to look forEscaping turned off for a value a user chose: | safe, raw, innerHTML. Sanitizers that allow active content such as data: URLs or SVG.
5. Act as another user, or as admin
This is the largest group, and the most varied. The code works. It just trusts the wrong thing.
Seen in the wild
- Trusting the requested role. Gogs CVE-2026-52804: adding a collaborator grants whatever access level the request asks for, including admin.
- Trusting a header. Gogs CVE-2026-25119: a header meant to come from a reverse proxy is accepted from anyone, so anyone can log in as anyone.
- Trusting the ID in the request. Kanboard CVE-2024-36399: send another project's ID and change its permissions.
- Changing state on a GET. Gogs CVE-2026-52800: a link is enough to make an organization owner hand over the organization.
- Trusting the Host header. Kanboard CVE-2025-52560: a password reset link is built from the request's Host header, so the reset token goes to the attacker's domain.
- Trusting a parse. Umbraco CVE-2025-27602: send an ID twice and the permission check fails to read it, so it lets the request through.
The code to look forAny decision about who you are, or what you may touch, that reads something the client controls.
6. Reach your internal network
Seen in the wildGogs CVE-2026-47267: a webhook points at a public address, which passes the check. That address then redirects to an internal one, and the redirect is followed without a second check.
The code to look forServer-side requests to a URL a user chose. Checks on the first host only, when redirects are followed.
7. Phish your users from your own domain
Seen in the wildGogs CVE-2026-52802, Kanboard CVE-2026-21879 and Umbraco CVE-2024-34071 share one trick. The redirect target //evil.com looks relative, passes the "same site" check, and the browser treats it as another site.
The code to look forRedirects to a URL from the request, guarded by string checks instead of a proper local-URL test.
8. Steal credentials or guess passwords
Seen in the wildGogs CVE-2026-26196: the API accepts access tokens in the URL, where logs, proxies and browser history keep them. Kanboard CVE-2025-52576: login lockout is keyed on the X-Forwarded-For header, so an attacker changes it on every guess.
The code to look forSecrets in query strings. Rate limits keyed on anything the client sets.
9. Take the service offline
Seen in the wildGogs CVE-2026-52814: an attacker opens SSH connections and never finishes the handshake. With no time limit, each one holds a file handle until the server runs out.
The code to look forNetwork handshakes, uploads and parsers with no time or size limit.
What a scanner can and cannot see
For every example above, Vybscan flags the vulnerable line in the release that shipped it. Then we run it again on the vendor's fixed release, and it stops flagging that code. That second check matters. A scanner that keeps flagging fixed code teaches developers to ignore it. Many of the checks behind these examples were written after studying these very advisories. That is how a scanner should learn: from real attacks, generalised to the pattern, and tested on other codebases so it is not tuned to one product.
Not every advisory has a pattern to match. The largest group of the rest is missing authorization. Novu, for example, published a run of advisories where an API key for one environment could read or change another environment's data. Each handler looked fine on its own. What was missing was a check that the record belonged to the caller.
Pattern matching cannot see a check that is not there. You have to know what the code should do. That is why Vybscan pairs its rules with an AI review that reads the code for missing ownership and permission checks.
How to use this map
- Triage by the left column. Fix findings that let an attacker run code, read files or act as admin first.
- Explain by the left column too. "An attacker can delete any file on the server" gets fixed faster than "CWE-22".
- Review by the right column. Each weakness has a small number of code shapes. Knowing them makes code review faster.
Frequently asked questions
What is the difference between a CWE and a CVE?
A CWE names a kind of weakness, such as SQL injection (CWE-89). A CVE names one specific vulnerability in one product, such as CVE-2026-33083 in DataEase. Many CVEs share one CWE.
Which vulnerabilities let an attacker run code on a server?
Most often command and argument injection (CWE-77, CWE-78, CWE-88), unsafe deserialization (CWE-502), and injection into interpreters such as SQL, JNDI or database connection strings (CWE-74, CWE-94). Path traversal that overwrites a file the server later runs leads to the same place.
Why is missing authorization so hard to find?
The vulnerable code is not wrong in itself. It is missing a check that the business rules require, such as confirming the user owns the record. A scanner has to know what the code should do, not only what it does.
Is an open redirect really a security issue?
Yes. It lets an attacker send a link that starts with your real domain and ends on theirs. That makes phishing for passwords and session tokens far more convincing.
For how Vybscan scores on the industry's standard test apps, see 97% on the OWASP Benchmark, and seven languages above 80%. For why we optimise for recall first, see In security, the bug you miss costs more than the alert you dismiss.
Sources: the published GitHub security advisories for Gogs, DataEase, Kanboard, Umbraco CMS and Novu; MITRE CWE.
See what Vybscan finds in your code
Code, dependency and secrets scanning on every pull request, for GitHub and GitLab.
Try Vybscan →