What is Path Equivalence Trailing Slash (CWE-49)?

TL;DR: CWE-49 lets an attacker bypass a path-based access rule by adding or removing a trailing slash that some resolvers treat as equivalent; the fix is normalizing trailing slashes before evaluating the rule.

What is Path Equivalence?

Path Equivalence: Trailing Slash (CWE-49) is a type of access-control bypass vulnerability that occurs when an application accepts a path with a trailing slash without recognizing that it may resolve to the same underlying resource as the path without it. As defined by the MITRE Corporation under CWE-49, this weakness has no official OWASP Top 10:2025 category mapping but is a direct child of Improper Resolution of Path Equivalence (CWE-41) and Improper Neutralization of Trailing Special Elements (CWE-162).

Quick Summary

A trailing slash typically distinguishes a directory reference from a file reference, but many web servers, frameworks, and reverse proxies normalize the two forms to the same route or resource anyway. When an access rule is written against only one form, that normalization gap becomes an exact bypass path.

Jump to: Quick Summary · Path Equivalence Overview · How Path Equivalence Works · Business Impact of Path Equivalence · Path Equivalence Attack Scenario · How to Detect Path Equivalence · How to Fix Path Equivalence · Framework-Specific Fixes for Path Equivalence · How to Ask AI to Check Your Code for Path Equivalence · Path Equivalence Best Practices Checklist · Path Equivalence FAQ · Vulnerabilities Related to Path Equivalence · References · Scan Your Own Site

Path Equivalence Overview

What: A path ending in a trailing slash resolves to the same resource as the path without it, but an access rule written against only one form treats them as different values.

Why it matters: Any access control implemented as an exact path-string match can be bypassed by whichever trailing-slash form the rule doesn’t cover.

Where it occurs: Web servers, reverse proxies, and application routers with inconsistent trailing-slash normalization across layers.

Who is affected: Applications enforcing path-based access rules as an exact string match rather than after normalization.

Who is NOT affected: Applications that normalize trailing slashes consistently before evaluating any access rule, at every layer of the request path.

How Path Equivalence Works

Root Cause

The application (or a layer in front of it) resolves a trailing-slash and non-trailing-slash form of the same path to the same resource, while an access rule is written against only one form.

Attack Flow

1. The attacker identifies a path-based access rule that blocks a specific route, e.g. /admin.
2. The attacker requests the same path with a trailing slash added, e.g. /admin/.
3. The access rule, written as an exact match for /admin, does not recognize /admin/ as the same blocked value.
4. The underlying router or server resolves /admin/ to the same protected resource, and the request succeeds.

Prerequisites to Exploit

• A path-based access rule is enforced via exact string matching.
• The underlying router, server, or framework resolves both the with-slash and without-slash forms to the same resource.
• The attacker can request either form of the path directly.

Vulnerable Code

app.use((req, res, next) => {
  if (req.path === "/admin") {
    return res.status(403).send("Forbidden");
  }
  next();
});

The rule matches only the exact string "/admin", so a request to /admin/ bypasses this check entirely while the router may still dispatch it to the same admin handler.

Secure Code

app.use((req, res, next) => {
  const normalized = req.path.replace(/\/+$/, "");
  if (normalized === "/admin") {
    return res.status(403).send("Forbidden");
  }
  next();
});

Stripping trailing slashes before the comparison ensures both /admin and /admin/ are evaluated identically against the access rule.

Business Impact of Path Equivalence

Confidentiality: Attackers may reach restricted routes or resources that an exact-match access rule was meant to protect.

Integrity: Attackers may reach administrative or write-capable endpoints bypassed by the same normalization gap.

• Exposure of administrative interfaces or protected routes via a trivial URL variation
• Inconsistent security posture across layers (proxy, server, application) that each normalize differently

Path Equivalence Attack Scenario

1. An attacker notices a web application blocks direct requests to /admin for unauthenticated users.
2. They instead request /admin/ (with a trailing slash).
3. The access-control middleware’s exact-match check does not recognize this as the blocked route.
4. The application’s router still dispatches /admin/ to the same admin handler, granting unauthorized access.

How to Detect Path Equivalence

Manual Testing

• Identify path-based access rules implemented as exact string matches.
• Test both the trailing-slash and non-trailing-slash forms of a value that should be blocked.
• Confirm whether every layer (proxy, server, framework) normalizes the two forms consistently.

Automated Scanners (SAST / DAST)

Static analysis can flag path comparisons using simple string equality, while dynamic testing confirms whether the live server actually routes both slash forms to the same protected resource.

PenScan Detection

PenScan’s scanner engines test path-based access controls with trailing-slash variants to confirm whether blocked resources remain reachable.

False Positive Guidance

If the web server or router treats the trailing-slash and non-trailing-slash forms as genuinely distinct resources (not equivalent), this specific bypass does not apply — confirm actual routing behavior before treating it as a real finding.

How to Fix Path Equivalence

• Normalize trailing slashes consistently before evaluating any path-based access rule.
• Apply the same access rule to both the with-slash and without-slash forms of a path.
• Align trailing-slash normalization behavior across every layer of the request path (proxy, server, framework).

Framework-Specific Fixes for Path Equivalence

• Node.js/Express: strip trailing slashes before comparison, as shown above, or enable strict routing consistently across all routes.
• Java/Spring: configure setUseTrailingSlashMatch(false) explicitly and ensure access rules are evaluated against the normalized path.
• Python/Django: rely on Django’s APPEND_SLASH setting consistently and apply access decorators to the canonical URL pattern, not a raw string comparison.
• PHP: normalize the request path (trim trailing slashes) before any access-control comparison.

How to Ask AI to Check Your Code for Path Equivalence

Path Equivalence Best Practices Checklist

✅ Normalize trailing slashes before evaluating any path-based access rule ✅ Apply access rules to both slash forms of a protected path ✅ Align trailing-slash handling across proxy, server, and application layers ✅ Test blocked routes with both slash variants during review

Path Equivalence FAQ

How does a trailing slash cause a path equivalence bypass?

A trailing slash normally signals a directory rather than a file, but some resolvers and web servers treat “filename” and “filename/” as equivalent, so a check written for one form can be bypassed by requesting the other.

How is this different from the other Path Equivalence variants?

Where CWE-42/46/48 involve dots or spaces inside or after a filename, CWE-49 specifically involves the directory-indicating trailing slash character causing ambiguous resolution between file and directory interpretations.

How would an attacker use this to bypass an access rule?

If a web server or application access rule is written to match a specific path string exactly (e.g. blocking “/admin”), requesting “/admin/” may bypass that exact-match rule while the server still routes the request to the same protected resource.

How do I detect this in my own application?

Test any path-based access rule by appending or removing a trailing slash from a value that should be blocked, and confirm whether the resource remains reachable either way.

How do I fix this correctly?

Normalize trailing slashes consistently before evaluating any access rule, and verify the rule is applied to both the with-slash and without-slash forms of the same path.

How does inconsistent trailing-slash handling cause this across different components?

A reverse proxy, web server, and application framework can each normalize trailing slashes differently, so a rule enforced correctly at one layer can still be bypassed if a request reaches another layer that resolves the two forms as equivalent.

How can PenScan help find this weakness?

PenScan tests path-based access controls with trailing-slash variants to confirm whether blocked resources are still reachable either way.

Vulnerabilities Related to Path Equivalence

References

• MITRE - CWE-49
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find this Path Equivalence variant and other risks before an attacker does.