The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Resultant

Implementation

Confidentiality
Integrity
Read Files or Directories
Modify Files or Directories

CVE-2002-1483
Read files with full pathname using multiple internal slash.
https://www.cve.org/CVERecord?id=CVE-2002-1483

CVE-1999-1456
Server allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) character in the filename.
https://www.cve.org/CVERecord?id=CVE-1999-1456

CVE-2004-0578
Server allows remote attackers to read arbitrary files via leading slash (//) characters in a URL request.
https://www.cve.org/CVERecord?id=CVE-2004-0578

CVE-2002-0275
Server allows remote attackers to bypass authentication and read restricted files via an extra / (slash) in the requested URL.
https://www.cve.org/CVERecord?id=CVE-2002-0275

CVE-2004-1032
Product allows local users to delete arbitrary files or create arbitrary empty files via a target filename with a large number of leading slash (/) characters.
https://www.cve.org/CVERecord?id=CVE-2004-1032

CVE-2002-1238
Server allows remote attackers to bypass access restrictions for files via an HTTP request with a sequence of multiple / (slash) characters such as http://www.example.com///file/.
https://www.cve.org/CVERecord?id=CVE-2002-1238

CVE-2004-1878
Product allows remote attackers to bypass authentication, obtain sensitive information, or gain access via a direct request to admin/user.pl preceded by // (double leading slash).
https://www.cve.org/CVERecord?id=CVE-2004-1878

CVE-2005-1365
Server allows remote attackers to execute arbitrary commands via a URL with multiple leading "/" (slash) characters and ".." sequences.
https://www.cve.org/CVERecord?id=CVE-2005-1365

CVE-2000-1050
Access directory using multiple leading slash.
https://www.cve.org/CVERecord?id=CVE-2000-1050

CVE-2001-1072
Bypass access restrictions via multiple leading slash, which causes a regular expression to fail.
https://www.cve.org/CVERecord?id=CVE-2001-1072

CVE-2004-0235
Archive extracts to arbitrary files using multiple leading slash in filenames in the archive.
https://www.cve.org/CVERecord?id=CVE-2004-0235

File Processing

File or Directory

//multiple/leading/slash ('multiple leading slash')

SFP16
Path Traversal

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Observed_Examples, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Path Issue - Multiple Leading Slash - //multiple/leading/slash