CVE-2009-4444: Microsoft IIS 5.x/6.x semicolon filename extension bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw enables remote code execution via a common upload path, and while the affected IIS versions are legacy, the high EPSS score signals active interest.

What it is

IIS 5.x and 6.x determine a file's extension using only the portion of the filename before a semicolon, so a file named .asp;.jpg is handled by asp.dll. This lets attackers bypass extension restrictions enforced by third-party upload applications and get uploaded content executed as ASP, CER, or ASA.

Impact

An attacker who can upload a file through a vulnerable application can have it executed as server-side script, leading to code execution in the IIS worker process context.

Attack surface

Reached remotely over HTTP by submitting a crafted filename to a third-party upload feature; the CVSS vector (AV:N/AC:M/Au:S) indicates network access, medium complexity, and some level of authentication, with no user interaction required.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.636 (99.2nd percentile), indicating elevated predicted exploitation activity.

What to do

• Patch or upgrade IIS to a supported version; IIS 5.x and 6.x are long out of support, so migrate to a current IIS release.
• Harden upload handling: reject or sanitize filenames containing semicolons and validate the final extension after any normalization.
• Rename uploaded files server-side to a safe extension and store them outside the web root, serving them only through a handler.
• Disable or restrict execution of ASP, CER, and ASA in upload directories via IIS handler mappings and request filtering.
• Apply least privilege to the IIS application pool identity to limit the impact of any executed uploaded file.

Detection

• Search IIS access and upload logs for filenames containing a semicolon followed by a second extension (e.g., .asp;, .cer;, .asa;).
• Alert on requests for files whose resolved handler is asp.dll but whose URL ends in an image or other safe extension.
• Monitor upload directories for newly written files with executable extensions or double extensions.
• Review web server logs for anomalous POST requests to upload endpoints followed by GET requests to the same path.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.