What is Path Equivalence Trailing Space (CWE-46)?

TL;DR: CWE-46 lets an attacker bypass a filename-based access check by appending a trailing space, which Windows silently strips when resolving the file; the fix is canonicalizing the filename before comparison.

What is Path Equivalence?

Path Equivalence: Trailing Space (CWE-46) is a type of access-control bypass vulnerability that occurs when an application accepts a filename with a trailing space without recognizing that it resolves to the same underlying file as the name without it. As defined by the MITRE Corporation under CWE-46, this weakness has no official OWASP Top 10:2025 category mapping but is a direct child of Improper Resolution of Path Equivalence (CWE-41) and Improper Neutralization of Trailing Special Elements (CWE-162), and can precede Authentication Bypass by Alternate Name (CWE-289).

Quick Summary

Like its trailing-dot sibling, this weakness exploits a Windows filename-resolution quirk: a trailing space is silently dropped when the OS resolves the file, so an access check that compares the raw request string never realizes it’s looking at the same protected resource under a slightly different label.

Jump to: Quick Summary · Path Equivalence Overview · How Path Equivalence Works · Business Impact of Path Equivalence · Path Equivalence Attack Scenario · How to Detect Path Equivalence · How to Fix Path Equivalence · Framework-Specific Fixes for Path Equivalence · How to Ask AI to Check Your Code for Path Equivalence · Path Equivalence Best Practices Checklist · Path Equivalence FAQ · Vulnerabilities Related to Path Equivalence · References · Scan Your Own Site

Path Equivalence Overview

What: A filename ending in a trailing space resolves to the same file as the name without it, but a string-comparison-based access check treats them as different values.

Why it matters: Any access control implemented as a raw string comparison can be bypassed with this one-character difference, and MITRE notes it can even feed into authentication-bypass scenarios.

Where it occurs: Windows-hosted applications performing filename or identifier-based access checks by direct string comparison.

Who is affected: Applications that compare filenames as literal strings before a Windows file API resolves them.

Who is NOT affected: Applications that canonicalize the filename via the OS’s own resolution function before comparing it against any access rule.

How Path Equivalence Works

Root Cause

The application’s access check compares the raw filename string, without accounting for Windows silently stripping a trailing space during actual path resolution.

Attack Flow

1. The attacker identifies a filename-based access check (e.g. blocking direct requests for admin.config).
2. The attacker appends a trailing space to the requested filename, e.g. admin.config .
3. The string-comparison check sees a different value than the blocked one and allows the request.
4. Windows resolves the trailing-space filename to the same underlying file, serving the blocked content anyway.

Prerequisites to Exploit

• The application performs a filename-based access check via direct string comparison.
• The application runs on Windows, where trailing spaces are stripped during path resolution.
• The attacker can control or influence the requested filename.

Vulnerable Code

string requested = Request.QueryString["file"];
if (requested == "admin.config")
{
    throw new UnauthorizedAccessException();
}
string content = File.ReadAllText(Path.Combine(baseDir, requested));

The check only blocks the exact string "admin.config", so a request for "admin.config " (with a trailing space) passes the comparison while Windows still resolves it to the same protected file.

Secure Code

string requested = Request.QueryString["file"];
string canonicalName = Path.GetFileName(Path.GetFullPath(Path.Combine(baseDir, requested)));
if (canonicalName.Equals("admin.config", StringComparison.OrdinalIgnoreCase))
{
    throw new UnauthorizedAccessException();
}
string content = File.ReadAllText(Path.Combine(baseDir, canonicalName));

Path.GetFullPath() resolves the filename the same way Windows itself will, so the trailing space is already stripped before the comparison runs, closing the bypass.

Business Impact of Path Equivalence

Confidentiality: Attackers may access files that a raw string-based access check was meant to protect.

Integrity: Attackers may reach a write-capable endpoint that was meant to be blocked by the same flawed comparison logic.

• Exposure of resources an application specifically tried to block by filename
• Potential feed into authentication-bypass scenarios where identifiers are compared the same way

Path Equivalence Attack Scenario

1. An attacker notices a web application explicitly blocks direct requests for admin.config.
2. They instead request admin.config (with a trailing space).
3. The application’s exact-match check does not recognize this as the blocked filename and serves the request.
4. Windows resolves the trailing-space filename to the same admin.config, and its contents are returned to the attacker.

How to Detect Path Equivalence

Manual Testing

• Identify filename-based access checks implemented as string comparisons.
• Append a trailing space to a value that should be blocked and confirm whether it is still served.
• Test any identifier comparisons that could feed into authentication decisions the same way.

Automated Scanners (SAST / DAST)

Static analysis can flag filename comparisons using simple string equality, while dynamic testing confirms whether a Windows-hosted target actually resolves a trailing-space variant to the blocked resource.

PenScan Detection

PenScan’s scanner engines test filename-based access controls with a trailing-space variant to confirm whether blocked resources remain reachable.

False Positive Guidance

On non-Windows deployments, a trailing space is typically treated as a literal character and does not cause equivalence, so this specific bypass may not be exploitable outside a Windows-hosted target — confirm the runtime OS before treating it as a real finding.

How to Fix Path Equivalence

• Canonicalize the filename with the OS’s own path-resolution function before any access-control comparison.
• Never implement filename-based access rules as a raw string equality check alone.
• Extend the same canonicalization discipline to any identifier comparison that could feed an authentication decision.

Framework-Specific Fixes for Path Equivalence

This weakness is specific to Windows filename resolution behavior; it has no equivalent bypass mechanism on Linux/macOS filesystems, so no forced-fit examples are given for those platforms.

• ASP.NET/.NET: canonicalize with Path.GetFullPath() and Path.GetFileName() before any comparison, as shown above.
• Java on Windows: use Paths.get(input).toRealPath() (when the file exists) or .normalize() to resolve the canonical filename before comparing it against any blocklist.

How to Ask AI to Check Your Code for Path Equivalence

Path Equivalence Best Practices Checklist

✅ Canonicalize filenames with the OS’s own resolution function before any comparison ✅ Never rely on raw string equality for filename-based access control ✅ Extend canonicalization to identifier comparisons used in authentication decisions ✅ Test blocked resources with a trailing-space variant during review

Path Equivalence FAQ

How does a trailing space bypass a filename-based check?

Windows silently strips a trailing space from a filename when resolving it, so “secret.txt “ and “secret.txt” open the exact same file even though they are different strings — a check comparing the raw string sees two different values.

How is this related to Path Equivalence Trailing Dot (CWE-42)?

Both are children of the same parent weakness, Improper Resolution of Path Equivalence (CWE-41), and share the same underlying mechanism: an OS-level normalization quirk that makes two differently-formatted filenames resolve to one file.

How could this also enable authentication bypass?

MITRE notes this weakness can precede Authentication Bypass by Alternate Name (CWE-289) — if a username or credential-related filename check also relies on raw string comparison, the same trailing-space trick can apply there too.

How do I detect this in my own application?

Append a trailing space to a filename value that should be blocked or restricted, and confirm whether the underlying resource is still reachable.

How do I fix this correctly?

Canonicalize the filename with the OS’s own path-resolution function before running any access check, so trailing whitespace is already resolved before comparison.

How does this differ in practical risk from Path Traversal?

Path Traversal escapes the restricted directory entirely; this weakness stays inside it but defeats a filename-level check via an equivalence quirk, so the impact is scoped to whatever that specific check was protecting.

How can PenScan help find this weakness?

PenScan tests filename-based access controls with trailing-space and other path-equivalence variants to confirm whether blocked resources are still reachable.

Vulnerabilities Related to Path Equivalence

References

• MITRE - CWE-46
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find this Path Equivalence variant and other risks before an attacker does.