68
separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help
to avoid CWE-434. Do not rely exclusively on a filtering mechanism that removes potentially
dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For
example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a
directory separator. Another possible error could occur when the filtering is applied in a way that
still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the
".../...//" string in a sequential fashion, two instances of "../" would be removed from the original
string, but the remaining characters would still form the "../" string.
Effectiveness = High
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2001-0467 "\..." in web server
https://www.cve.org/CVERecord?id=CVE-2001-0467
CVE-2001-0615 "..." or "...." in chat server
https://www.cve.org/CVERecord?id=CVE-2001-0615
CVE-2001-0963 "..." in cd command in FTP server
https://www.cve.org/CVERecord?id=CVE-2001-0963
CVE-2001-1193 "..." in cd command in FTP server
https://www.cve.org/CVERecord?id=CVE-2001-1193
CVE-2001-1131 "..." in cd command in FTP server
https://www.cve.org/CVERecord?id=CVE-2001-1131
CVE-2001-0480 read of arbitrary files and directories using GET or CD with "..." in Windowsbased
FTP server.
https://www.cve.org/CVERecord?id=CVE-2001-0480
CVE-2002-0288 read files using "." and Unicode-encoded "/" or "\" characters in the URL.
https://www.cve.org/CVERecord?id=CVE-2002-0288
CVE-2003-0313 Directory listing of web server using "..."
https://www.cve.org/CVERecord?id=CVE-2003-0313
CVE-2005-1658 Triple dot
https://www.cve.org/CVERecord?id=CVE-2005-1658
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 981 SFP Secondary Cluster: Path Traversal 888 2409
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Notes
Maintenance
This manipulation-focused entry is currently hiding two distinct weaknesses, so it might need
to be split. The manipulation is effective in two different contexts: it is equivalent to "..\.." on
Windows, or it can take advantage of incomplete filtering, e.g. if the programmer does a singlepass
removal of "./" in a string (collapse of data into unsafe value, CWE-182).
CWE Version 4.14
CWE-33: Path Traversal: '....' (Multiple Dot)
CWE-33: Path Traversal: '....' (Multiple Dot)