$ cve CVE-2001-0333 JSON

CVE-2001-0333 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 90.8% (pctl 100)

Patch early

A public exploit exists.

Description

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	90.77% — more likely to be exploited than 100% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2001-06-27
Last modified	2026-06-16

Affected (1)

Vendor	Product
microsoft	internet information server

Public exploits

Source	Title	Date
exploit-db	Microsoft IIS/PWS - CGI Filename Double Decode Command Execution (MS01-026) (Metasploit)	2011-01-08
exploit-db	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (2)	2001-05-16
exploit-db	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (1)	2001-05-15
exploit-db	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (3)	2001-05-15
exploit-db	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (4)	2001-05-15
exploit-db	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (5)	2001-05-15
exploit-db	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (6)	2001-05-15
exploit-db	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (7)	2001-05-15
exploit-db	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (8)	2001-05-15

References

→ the Explorer · watch your stack · NVD