QwikSec

Security Database

CVE

CWE

Training

CWE Database
/

CWE-49

Back to CWE list

CWE-49

Path Equivalence: 'filename/' (Trailing Slash)

Variant
Incomplete

Description

The product accepts path input in the form of trailing slash ('filedir/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Common Consequences

Scope

Confidentiality
Integrity

Impact

Read Files or Directories, Modify Files or Directories

CVE-2002-0253

Overlaps infoleak

CVE-2001-0446

Application server allows remote attackers to read source code for .jsp files by appending a / to the requested URL.

CVE-2004-0334

Bypass Basic Authentication for files using trailing "/"

CVE-2001-0893

Read sensitive files with trailing "/"

CVE-2001-0892

Web server allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /.

CVE-2004-1814

Directory traversal vulnerability in server allows remote attackers to read protected files via .. (dot dot) sequences in an HTTP request.

Applicable Platforms

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now