CVE-2001-0333

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute...

7.5 HighPublic exploit

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "" characters twice.

Exploit likelihood

90.8%Up 18.2 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "" characters twice.

Record: CVE-2001-0333
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "" characters twice.

Record: CVE-2001-0333
Updated: 2026-11-02

EUVDEUVD-2001-0333 No score

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "" characters twice.

Record: EUVD-2001-0333
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j59q-fjq9-v929 No score

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute...

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "" characters twice.

Record: GHSA-j59q-fjq9-v929
Updated: 2026-11-02

Affected products

microsoft internet information server

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Microsoft IIS/PWS - CGI Filename Double Decode Command Execution (MS01-026) (Metasploit)	2011-01-08
Exploit-DB	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (1)	2001-05-15
Exploit-DB	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (2)	2001-05-16
Exploit-DB	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (3)	2001-05-15
Exploit-DB	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (4)	2001-05-15
Exploit-DB	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (5)	2001-05-15
Exploit-DB	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (6)	2001-05-15
Exploit-DB	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (7)	2001-05-15
Exploit-DB	Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (8)	2001-05-15
Metasploit	MS01-026 Microsoft IIS/PWS CGI Filename Double Decode Command Execution	2001-05-15

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2001-0333 is a high vulnerability (CVSS 7.5) in Microsoft Internet Information Server, published June 27, 2001. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.8%, the 99th percentile. No source names a fixed version.

References

Show 5 moreShow less