If one trailing dot can confuse a path check, several can too. CWE-43 covers input shaped like filedir.... accepted without appropriate validation, leading to ambiguous path resolution. It is a sibling of CWE-42, the single dot form, and sits under the general path equivalence class, CWE-41.
It matters for any server or application that makes a decision from the text of a path before the file system gets a chance to normalize it.
How it happens
A protection rule is written against a canonical name. The request arrives with extra dots appended. The rule compares strings and sees no match, so it neither blocks nor routes the request as intended. A later layer strips the dots, as some platforms do, and resolves to the protected object.
Sanitizers add a second way in. A filter that removes one trailing dot, or removes dots in a single pass, can be beaten by input with more of them. MITRE warns more generally against relying on filtering that removes dangerous characters, because it behaves like a denylist and can be incomplete.
The record has one example: multiple trailing dots allowed a directory listing (CVE-2004-0281). A directory listing is a quiet leak. It shows which files exist, including backups and old versions, and tells the attacker where to aim next.
// Vulnerable: strips exactly one trailing dot, once
String p = requested.endsWith(".") ? requested.substring(0, requested.length() - 1) : requested;
if (isProtected(p)) deny();
// "dir...." becomes "dir..." and is no longer matched
What an attacker gains
MITRE lists reading and modifying files and directories as the impact, so confidentiality and integrity are both in play. Directory listings and source disclosure are the typical first results.
How to find it
Test protected paths and directories with several trailing dots in a staging copy, and compare responses with the clean request. Include listings: ask for a directory with extra dots and see if an index appears.
How to fix it
- Canonicalize with the platform API, then decide. Do not hand write the stripping.
- Reject any name that ends in a dot or a space, rather than trying to clean it.
- Turn off automatic directory listings unless they are required.
- Apply least privilege on the file system so that a bypass still reveals little.
Path real = docRoot.resolve(requested).normalize();
if (requested.endsWith(".") || !real.startsWith(docRoot)) throw new SecurityException();
if (isProtected(real)) deny();
If the bug is in a web server you run rather than code you wrote, patching is the fix. The free scan at gold.safeguard.sh/scan checks a dependency file in your browser, no login.
Quick check
Why is stripping one dot not enough?
The attacker can add more. Single pass cleanup leaves residual dots and the mismatch remains. Reject the form or canonicalize through the platform API.
