Description
The product accepts path input in the form of trailing slash ('filedir/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Potential Impact
Confidentiality, Integrity
Read Files or Directories, Modify Files or Directories
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2002-0253 | Overlaps infoleak |
| CVE-2001-0446 | Application server allows remote attackers to read source code for .jsp files by appending a / to the requested URL. |
| CVE-2004-0334 | Bypass Basic Authentication for files using trailing "/" |
| CVE-2001-0893 | Read sensitive files with trailing "/" |
| CVE-2001-0892 | Web server allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /. |
| CVE-2004-1814 | Directory traversal vulnerability in server allows remote attackers to read protected files via .. (dot dot) sequences in an HTTP request. |
Related Weaknesses
Taxonomy Mappings
- PLOVER: — filedir/ (trailing slash, trailing /)
- Software Fault Patterns: SFP16 — Path Traversal
Frequently Asked Questions
What is CWE-49?
CWE-49 (Path Equivalence: 'filename/' (Trailing Slash)) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Variant-level weakness. The product accepts path input in the form of trailing slash ('filedir/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system...
How can CWE-49 be exploited?
Attackers can exploit CWE-49 (Path Equivalence: 'filename/' (Trailing Slash)) to read files or directories, modify files or directories. This weakness is typically introduced during the Implementation, Operation phase of software development.
How do I prevent CWE-49?
Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.
What is the severity of CWE-49?
CWE-49 is classified as a Variant-level weakness (Low-Medium abstraction). It has been observed in 6 real-world CVEs.