CWE-41: Improper Resolution of Path Equivalence

BaseIncomplete

The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.

Back to CWE Lookup

Extended Description

Path equivalence is usually employed in order to circumvent access controls expressed using an incomplete set of file name or file path representations. This is different from path traversal, wherein the manipulations are performed to generate a name for a different object.

Technical Details

Structure: Simple
Vulnerability Mapping: ALLOWED

Applicable To

Languages

Not Language-Specific

Platforms

Detection Methods

Method

Automated Static Analysis - Binary or Bytecode

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis

Method

Manual Static Analysis - Binary or Bytecode

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies

Method

Dynamic Analysis with Automated Results Interpretation

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner Web Services Scanner Database Scanners

Method

Dynamic Analysis with Manual Results Interpretation

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer

Method

Manual Static Analysis - Source Code

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections)

Effectiveness

High

Method

Automated Static Analysis - Source Code

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer

Method

Architecture or Design Review

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

Effectiveness

High

Code Examples & CVEs

Observed CVE Examples (50)

Source code disclosure using trailing dot

Source code disclosure using trailing dot

Source code disclosure using trailing dot or trailing encoding space "%20"

Source code disclosure using trailing dot

Bypass directory access restrictions using trailing dot in URL

Bypass directory access restrictions using trailing dot in URL

Bypass check for ".lnk" extension using ".lnk."

Source disclosure via trailing encoded space "%20"

Source disclosure via trailing encoded space "%20"

Source disclosure via trailing encoded space "%20"

Source disclosure via trailing encoded space "%20"

Source disclosure via trailing encoded space "%20"

Source disclosure via trailing encoded space "%20"

Source disclosure via trailing encoded space "%20"

Multi-Factor Vulnerability (MFV). directory traversal and other issues in FTP server using Web encodings such as "%20"; certain manipulations have unusual side effects.

Trailing space ("+" in query string) leads to source code disclosure.

Filenames with spaces allow arbitrary file deletion when the product does not properly quote them; some overlap with path traversal.

"+" characters in query string converted to spaces before sensitive file/extension (internal space), leading to bypass of access restrictions to the file.

Overlaps infoleak

Application server allows remote attackers to read source code for .jsp files by appending a / to the requested URL.

Bypass Basic Authentication for files using trailing "/"

Read sensitive files with trailing "/"

Web server allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /.

Directory traversal vulnerability in server allows remote attackers to read protected files via .. (dot dot) sequences in an HTTP request.

Read files with full pathname using multiple internal slash.

Server allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) character in the filename.

Server allows remote attackers to read arbitrary files via leading slash (//) characters in a URL request.

Server allows remote attackers to bypass authentication and read restricted files via an extra / (slash) in the requested URL.

Product allows local users to delete arbitrary files or create arbitrary empty files via a target filename with a large number of leading slash (/) characters.

Server allows remote attackers to bypass access restrictions for files via an HTTP request with a sequence of multiple / (slash) characters such as http://www.example.com///file/.

Product allows remote attackers to bypass authentication, obtain sensitive information, or gain access via a direct request to admin/user.pl preceded by // (double leading slash).

Server allows remote attackers to execute arbitrary commands via a URL with multiple leading "/" (slash) characters and ".." sequences.

Access directory using multiple leading slash.

Bypass access restrictions via multiple leading slash, which causes a regular expression to fail.

Archive extracts to arbitrary files using multiple leading slash in filenames in the archive.

Directory listings in web server using multiple trailing slash

web framework for .NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash)

Server allows remote attackers to read source code for executable files by inserting a . (dot) into the URL.

Server allows remote attackers to read password-protected files via a /./ in the HTTP request.

Possibly (could be a cleansing error)

"/./////etc" cleansed to ".///etc" then "/etc"

Server allows remote attackers to view password protected files via /./ in the URL.

List directories using desired path and "*"

List files in web server using "*.ext"

Proxy allows remote attackers to bypass denylist restrictions and connect to unauthorized web servers by modifying the requested URL, including (1) a // (double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3) a /./, or (4) URL-encoded characters.

application check access for restricted URL before canonicalization

CGI source disclosure using "dirname/../cgi-bin"

Multiple web servers allow restriction bypass using 8.3 names instead of long names

Source code disclosure using 8.3 file name.

Multi-Factor Vulnerability. Product generates temporary filenames using long filenames, which become predictable in 8.3 format.

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-41 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-41, Improper Resolution of Path Equivalence, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Apply Input Validation controls for Improper Resolution of Path Equivalence

MITRE associates mitigation with Implementation; the listed strategies include Input Validation, and Output Encoding; documented detection approaches include Automated Static Analysis - Binary or Bytecode, Manual Static Analysis - Binary or Bytecode, Dynamic Analysis with Automated Results Interpretation, and Dynamic Analysis with Manual Results Interpretation. Use these source-defined anchors to turn CWE-41 into implementation, review, and verification checks for the affected component.

CWE-41: Improper Resolution of Path Equivalence — MITRE CWE

Triage CWE-41 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-41, Improper Resolution of Path Equivalence, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-41

Apply MITRE's full root-cause mapping guidance when using CWE-41, Improper Resolution of Path Equivalence. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-41 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-41, Improper Resolution of Path Equivalence. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-41: Improper Resolution of Path Equivalence?+

CWE-41: Improper Resolution of Path Equivalence is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object. Path equivalence is usually employed in order to circumvent access controls expressed using an incomplete set of file name or file path representations. This is different from path traversal, wherein the manipulations are performed to generate a name for a different object.

What are the security consequences of Improper Resolution of Path Equivalence?+

If exploited, CWE-41 (Improper Resolution of Path Equivalence) it can compromise Confidentiality, Integrity and Access Control, leading to outcomes such as Read Files or Directories, Modify Files or Directories and Bypass Protection Mechanism.

How is Improper Resolution of Path Equivalence detected?+

CWE-41 can be detected using Automated Static Analysis - Binary or Bytecode, Manual Static Analysis - Binary or Bytecode, Dynamic Analysis with Automated Results Interpretation, Dynamic Analysis with Manual Results Interpretation, Manual Static Analysis - Source Code and Automated Static Analysis - Source Code. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Improper Resolution of Path Equivalence?+

CWE-41 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Improper Resolution of Path Equivalence?+

MITRE documents real CVEs mapped to CWE-41, including CVE-2000-1114, CVE-2002-1986, CVE-2004-2213, CVE-2005-3293 and CVE-2004-0061. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-41 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More

Find Related CVEs

Search for vulnerabilities that exploit CWE-41

CVE vs CWE: What's the Difference?

Understanding vulnerabilities vs weaknesses

Understanding CVSS Scoring

How vulnerability severity is measured

View Full MITRE Entry

Complete technical details and references

Advertisement