While trying to replicate a security vulnerability on my local machine I realized that PHP on my machine does not decode %2e as a dot. I created the following test-file:

<?php var_dump(file_exists("%2e%2e/file_that_exists"));

Which always returns false. What are the server requirements that an attack like this would work?

I'm running Apache/2.4.18 with PHP 7.0.25-0ubuntu0.16.04.1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.