CWE-53 describes path input with multiple internal backslashes, such as \multiple\\internal\backslash, accepted without appropriate validation. MITRE says this can lead to ambiguous path resolution and access to unintended files.
It is the backslash counterpart of CWE-51 and belongs to the family under CWE-41. The record lists no observed CVEs, so it is mostly a review item.
How it happens
A rule is written for a single separator, or for forward slashes only. On a platform that accepts backslashes, doubled ones collapse to one separator at the file layer, while the rule compared a different string.
What an attacker gains
MITRE lists reading and modifying files and directories.
How to find it
No detection method is listed. In a staging environment, send paths with doubled backslashes to each file handling endpoint and compare outcomes with the plain form. Review validators for separator handling.
How to fix it
Convert separators to one form, canonicalize with the platform API, then check containment and apply access rules. Prefer an allowlist of filename characters that excludes both slash types.
from pathlib import PureWindowsPath
p = PureWindowsPath(raw)
if len(p.parts) != 1:
raise ValueError("single name only")
The free dependency scan at gold.safeguard.sh/scan runs in your browser without a login.
Quick check
Why does a forward slash only rule miss this?
Windows accepts backslashes as separators and collapses repeats, so the opened path matches a protected file that the rule never recognized.
