CVE-2001-0333

HighPublished

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters...

Published: Sep 18, 2001
Updated: Aug 8, 2024
Assigning CNA: mitre
Evidence observed: May 15, 2001

Primary CVSS

7.5/ 10High

nvd · CVSS 2.0

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS probability estimate

90.8%

High · next 30 days

Percentile: 99.8%
Model date: Oct 13, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

MS01-026 Microsoft IIS/PWS CGI Filename Double Decode Command ExecutionModule
modules/exploits/windows/iis/ms01_026_dbldecode.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: 28f4223c60caRelated tool
Declared conditions
- platform: Windows($.exploit_windows/iis/ms01_026_dbldecode.platform)
- verification: check_declared($.exploit_windows/iis/ms01_026_dbldecode.check)

Microsoft IIS/PWS - CGI Filename Double Decode Command Execution (MS01-026) (Metasploit)Exploit
Metasploit · windows · Jan 8, 2011
Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (1)Exploit
Filip Maertens · windows · May 15, 2001
Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (2)Exploit
HuXfLuX · windows · May 16, 2001
Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (3)Exploit
Cyrus The Gerat · windows · May 15, 2001
Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (4)Exploit
MovAX · windows · May 15, 2001
Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (5)Exploit
Leif Jakob · windows · May 15, 2001
Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (6)Exploit
A.Ramos · windows · May 15, 2001
Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (7)Exploit
Gary O'Leary-Steele · windows · May 15, 2001
Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (8)Exploit
Roelof · windows · May 15, 2001

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.