CVE-2001-0333: Microsoft IIS directory traversal via double-encoded dot-dot-backslash allows command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution on an internet-facing web server with very high EPSS and a documented vendor patch makes this an urgent remediation target.

What it is

IIS 5.0 and earlier fails to properly neutralize doubly encoded ".." and "\" sequences, allowing directory traversal. Because the traversal reaches executable content, a remote attacker can run arbitrary commands on the server. This is a pre-authentication, network-reachable flaw in a widely deployed web server.

Impact

An attacker gains the ability to execute arbitrary commands with the privileges of the IIS service account, which can lead to full server compromise. No confidentiality, integrity or availability guarantee remains on the host.

Attack surface

Reached over the network via HTTP requests to the IIS web service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The crafted request is sent directly to the server.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.9077, 99.8th percentile), indicating strong likelihood of exploitation activity. References include the Microsoft bulletin MS01-026 and CERT advisory CA-2001-12, both of which document the issue.

What to do

• Apply Microsoft security bulletin MS01-026 or the corresponding patch for IIS 5.0 and earlier immediately.
• If patching is not possible, disable or remove unnecessary IIS components and ISAPI extensions, and restrict the web root to non-executable content.
• Run IIS under a low-privilege account and apply filesystem ACLs that prevent the service account from writing or executing outside the web root.
• Use a reverse proxy or URL normalization layer that rejects doubly encoded traversal sequences before they reach IIS.
• Retire or isolate IIS 5.0 hosts, as the platform is long out of support.

Detection

• Inspect HTTP request logs for doubly encoded traversal patterns such as %252e%252e%255c or ..%5c variants.
• Alert on requests containing encoded backslashes or dot-dot sequences targeting executable paths (e.g., cmd.exe, scripts, system directories).
• Monitor IIS worker process (inetinfo.exe/w3wp.exe) for unexpected child processes or command-shell execution.
• Correlate web server errors (500/404) with subsequent process creation events on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.