Skip to content
Fencer Vulns
high 7.5

CVE-2001-0333 in the critical feed json

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and…

published 2001-06-27 25 y ago modified 2026-06-16 4 mo ago also EUVD-2001-0333

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
90.8%
EPSS 90.8% chance of exploitation in 30 days, percentile 99.8%
public exploits
10
Metasploit, Exploit-DB

Summary

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.

Timeline

  1. First public exploit (Metasploit exploit/windows/iis/ms01_026_dbldecode)
  2. Published

Exploit prediction

90.77% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/iis/ms01_026_dbldecode MS01-026 Microsoft IIS/PWS CGI Filename Double Decode Command Execution metasploit exploit, excellent rank, 2001-05-15
  • EDB-20842 Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (8) remote, 2001-05-15
  • EDB-20841 Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (7) remote, 2001-05-15
  • EDB-20840 Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (6) remote, 2001-05-15
  • EDB-20839 Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (5) remote, 2001-05-15
  • EDB-20838 Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (4) remote, 2001-05-15
  • EDB-20837 Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (3) remote, 2001-05-15
  • EDB-20836 Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (2) remote, 2001-05-16
  • EDB-20835 Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (1) remote, 2001-05-15
  • EDB-16467 Microsoft IIS/PWS - CGI Filename Double Decode Command Execution (MS01-026) (Metasploit) remote, 2011-01-08

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.