CWE-51 covers path input with multiple internal slashes, like /multiple//internal/slash, accepted without appropriate validation. MITRE says this leads to ambiguous path resolution and may let an attacker reach unintended files.
It is part of the path equivalence family under CWE-41 and a neighbor of CWE-50, the leading slash form.
How it happens
A rule matches a literal sequence such as /private/data. A request for /private//data has the same meaning to the file system and a different spelling to the rule. The record lists one example: reading files with a full pathname using a multiple internal slash (CVE-2002-1483).
What an attacker gains
MITRE lists reading and modifying files and directories.
How to find it
No detection technique is listed. Test protected paths with doubled internal slashes in a staging environment and compare responses with the clean request. Review rules that match literal path strings.
How to fix it
Collapse repeated separators with the platform's normalization function before any check, and decide only on the normalized path.
import posixpath
clean = posixpath.normpath(raw_path) # "/a//b" becomes "/a/b"
Keep servers and proxies updated. The free scan at gold.safeguard.sh/scan works in the browser with no login.
Quick check
What should be compared in an access rule?
The normalized path, never the raw string.
