CWEweakness

CWE-42 Path Equivalence: 'filename.' (Trailing Dot)

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Common consequences

• Access Control: Bypass Protection Mechanism

Observed examples

• CVE-2000-1114: Source code disclosure using trailing dot • CVE-2002-1986: Source code disclosure using trailing dot • CVE-2004-2213: Source code disclosure using trailing dot (CWE-42) or trailing encoded space "%20" (CWE-46) • CVE-2005-3293: Source code disclosure using trailing null (CWE-158) or trailing dot (CWE-42). • CVE-2004-0061: Bypass directory access restrictions using trailing dot in URL • CVE-2000-1133: Bypass directory access restrictions using trailing dot in URL • CVE-2001-1386: Bypass check for ".lnk" extension using ".lnk."

Related

Observed example · CVE (7)

  • CVE-2005-3293 Xerver 4.17 allows remote attackers to (1) obtain source code of scripts via a request with a trailing "." (dot) or (2) list directory… vulnerability
  • CVE-2004-2213 Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to obtain the source code for scripts via a (1) trailing dot (".") or (2)… vulnerability
  • CVE-2004-0061 WWW File Share Pro 2.42 and earlier allows remote attackers to bypass directory access restrictions via (1) a URL with a trailing . vulnerability
  • CVE-2002-1986 Perception LiteServe 2.0 through 2.0.1 allows remote attackers to obtain the source code of CGI scripts via an HTTP request with a trailing… vulnerability
  • CVE-2001-1386 WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a ".lnk." extension, which bypasses… vulnerability
  • CVE-2000-1114 Unify ServletExec AS v3.0C allows remote attackers to read source code for JSP pages via an HTTP request that ends with characters such as… vulnerability
  • CVE-2000-1133 Authentix Authentix100 allows remote attackers to bypass authentication by inserting a . vulnerability

Child of · CWE (2)

  • CWE-162 Improper Neutralization of Trailing Special Elements weakness
  • CWE-41 Improper Resolution of Path Equivalence weakness

Referenced by CVE · weakness (1)

  • CVE-2026-52884 Notepad++ is a free and open-source source code editor. vulnerability

Referenced by CWE · child of (1)

  • CWE-43 Path Equivalence: 'filename....' (Multiple Trailing Dot) weakness