Three or more dots followed by a slash in url causes an internal server error

Question

On my site, if a url contains three or more dots followed by a slash, an internal server error (500) is given.

The server runs linux and apache 2.0.63.

Anyone knows what may be the cause?

Thanks!

Answer 1

It's possible you are seeing the error because two periods '..' can be used to step back up a folder level, and the server may be detecting it as a potential security breach (someone trying to get into folders they shouldn't) or it could be that it's actually trying to navigate to that folder and doesn't have access to do it.