Path Equivalence: '//multiple/leading/slash'
CWE-50
The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2.
Latest Path Equivalence: '//multiple/leading/slash' vulnerabilities
- 8.8 High severity
asyncssh: Improper Limitation of a Pathname to a Restricted Directory
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes on
- 8.2 High severity
OTP: Path Equivalence: '//multiple/leading/slash'
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normalises the request URI wit
- 7.5 High severity
vite: Use of Incorrectly-Resolved Name or Reference
Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the