Path Traversal: '...' (Triple Dot)
CWE-32
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '...' (triple dot) sequences that can resolve to a location that is outside of that directory.
The '...' manipulation is useful for bypassing some path traversal protection schemes. On some Windows systems, it is equivalent to.... and might bypass checks that assume only two dots are valid. Incomplete filtering, such as removal of./ sequences, can ultimately produce valid.. sequences due to a collapse into unsafe value (CWE-182).
We track 2 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.5.
How this weakness is prevented
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Latest Path Traversal: '...' (Triple Dot) vulnerabilities
- 7.5 High severity
Sterling Secure Proxy: Improper Limitation of a Pathname to a Restricted Directory
IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot dot" sequences (/.../) to view arbitrary f
- 7.5 High severity
vsm LTC Time Sync (vTimeSync): Path Traversal: '...' (Triple Dot)
The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system.