# Path check vs loader mismatch

A path validated by one component but opened or loaded by another that reinterprets it

_Area: Memory corruption and native code. Seen in 2 disclosed reports; one confirmed bounty: $2,500; latest 2026-04-29. Updated 2026-11-02._

## How it works
A security check and the code that actually opens or loads a path disagree about what the path means. The checker resolves `..`, joins onto a root, or truncates to a fixed buffer; the loader splits on a delimiter, treats the remainder as an opaque archive entry name, or passes the raw string to the OS. The checked string and the used string are then different objects, and the check passes on a path the loader never touches. The broken assumption is that both sides interpret the path identically.

## Where it shows up
- A policy/permission check calling `getCanonicalPath()` or `realpath()` while a class loader or archive reader splits on `.jar/` or similar and uses the tail literally [E1](https://bugbountylibrary.com/r/h1%3A3452696.md)
- `filepath.Join(root, dir)` where `dir` may be absolute, silently discarding `root` [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-8gmg-3w2q-65f4.md)
- Fixed-size buffers just under a platform limit (256 vs MAX_PATH 260) feeding `ShellExecute` or similar [E3](https://bugbountylibrary.com/r/h1%3A544096.md)
- Debug/inspector commands concatenating a remote-supplied filename into a local temp path [E2](https://bugbountylibrary.com/r/h1%3A2995025.md)

## How to review
Find every place a path is validated and every place it is consumed; confirm they are the same string after the same transformation. The invariant: the exact bytes the loader opens must be the bytes the check approved, with no re-interpretation (canonicalization, truncation, delimiter split, root-dropping join) in between. Check that joins reject absolute inputs and that fixed buffers cannot truncate a meaningful suffix like an extension.

## How finders spotted it
- Compared the policy's `getCanonicalPath()` against the loader's `indexOf('.jar/')` literal-entry handling and saw the two interpretations diverge [E1](https://bugbountylibrary.com/r/h1%3A3452696.md)
- After a sibling inspector command was fixed, re-read all commands in the same handler and noticed `live_reload` accepted remote filenames concatenated raw into a temp path [E2](https://bugbountylibrary.com/r/h1%3A2995025.md)
- Noticed a 256-byte buffer against the 260 MAX_PATH limit and reasoned truncation could rewrite the extension [E3](https://bugbountylibrary.com/r/h1%3A544096.md)
- Read the injection staging code and saw `filepath.Join` with `/proc/<pid>/root` drops the root for absolute paths [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-8gmg-3w2q-65f4.md)

## Variants seen
- Canonicalize-vs-literal archive entry split [E1](https://bugbountylibrary.com/r/h1%3A3452696.md)
- Raw concatenation of remote filename into temp path [E2](https://bugbountylibrary.com/r/h1%3A2995025.md)
- Fixed-buffer truncation changing the effective extension [E3](https://bugbountylibrary.com/r/h1%3A544096.md)
- Root-dropping join in a confinement check [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-8gmg-3w2q-65f4.md)

## Impact and severity
Reached AllPermission from sandboxed disc content when chained with a signature-verification skip [E1](https://bugbountylibrary.com/r/h1%3A3452696.md); RCE via DLL overwrite [E2](https://bugbountylibrary.com/r/h1%3A2995025.md); RCE via ShellExecute [E3](https://bugbountylibrary.com/r/h1%3A544096.md); host file overwrite and possible local privilege escalation [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-8gmg-3w2q-65f4.md). Severity rises with the privilege of the writing/loading process and with chaining to a second weakness [E1](https://bugbountylibrary.com/r/h1%3A3452696.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-8gmg-3w2q-65f4.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **go.opentelemetry.io/obi (go)** >= 0.4.0, < 0.8.0, fixed in 0.8.0: OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted T (CVE-2026-41433). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-8gmg-3w2q-65f4.md

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A3452696.md
- E2: https://bugbountylibrary.com/r/h1%3A2995025.md
- E3: https://bugbountylibrary.com/r/h1%3A544096.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-8gmg-3w2q-65f4.md