CWE-52 is path equivalence using multiple trailing slashes, /multiple/trailing/slash//. The product accepts such input without appropriate validation, so path resolution becomes ambiguous.
It is a sibling of CWE-49, the single trailing slash, within the family under CWE-41. MITRE lists web based platforms.
How it happens
A server decides whether to show an index page, a file or a directory listing based on the shape of the path. Extra slashes at the end can push the request past the code that would normally select the index file or deny the listing. The record has one example: directory listings in a web server using multiple trailing slashes (CVE-2002-1078).
A directory listing reveals file names, including backups, exports and forgotten test files.
What an attacker gains
MITRE lists reading and modifying files and directories. Listings are reconnaissance, and what they reveal often leads to direct reads.
How to find it
Request each directory on a staging copy with several trailing slashes and compare to the plain request. A listing where none is expected is a finding.
How to fix it
- Disable automatic directory listings unless needed.
- Normalize paths early and decide on the canonical form.
- Remove stray files from served directories, and keep backups elsewhere.
import posixpath
p = posixpath.normpath(raw) if raw != "/" else "/"
Update web server software when advisories apply. A free browser scan at gold.safeguard.sh/scan needs no login.
Quick check
What did the recorded case expose?
Directory listings from a web server, using multiple trailing slashes in the request.
