Vulnerability record · CVE-2003-1041 · published 14 June 2004
CVE-2003-1041: Internet Explorer directory traversal flaw enables arbitrary program execution
Microsoft · Ie
Internet Explorer 5.x and 6.0 mishandles URLs containing ".." sequences and a filename ending in "::", treating the file as a .chm even without that extension. This lets a remote attacker bypass extension-based handling and execute arbitrary programs. The record notes the bug may overlap CVE-2004-0475.
Description
Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution with public exploit references and very high EPSS, though the affected IE versions are legacy and no KEV listing exists.
What it is
Internet Explorer 5.x and 6.0 mishandles URLs containing ".." sequences and a filename ending in "::", treating the file as a .chm even without that extension. This lets a remote attacker bypass extension-based handling and execute arbitrary programs. The record notes the bug may overlap CVE-2004-0475.
Impact
An attacker can execute arbitrary programs on the victim's machine, giving code execution in the context of the logged-on user. This can lead to full system compromise depending on user privileges.
Attack surface
Reached remotely over the network via a crafted URL or web content rendered by Internet Explorer; no authentication is required per the CVSS vector (AV:N/AC:L/Au:N). User interaction such as visiting a malicious page or link is implied by the browser-based vector, though the record does not state it explicitly.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.5261, 98.9th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.
What to do
- Apply Microsoft security bulletin MS04-023 or the corresponding IE cumulative update.
- Upgrade or retire Internet Explorer 5.x/6.0, which are long out of support.
- Block or restrict access to untrusted web content and enforce browser security zones.
- Disable or restrict CHM/HTML Help handling where not required.
- Monitor vendor and CERT/CC advisories for updated guidance.
Detection
- Inspect web proxy and IDS logs for URLs containing ".." sequences combined with filenames ending in "::".
- Alert on CHM/HTML Help file execution originating from browser processes or temporary internet files.
- Monitor for unexpected child processes spawned by iexplore.exe.
- Review endpoint telemetry for program execution from browser cache or download directories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-1041 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-1041), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
