Cybersecurity glossary
What is Path Confusion?
Learn what path confusion is, how reverse proxies and apps disagree on /;/, encoded dots, and normalization, how it bypasses filters, and how to canonicalize paths consistently.
Definition
Path Confusion is a vulnerability class in which different components—browsers, reverse proxies, WAFs, and application routers—parse or normalize the same URL path differently, so security checks see one path while the handler executes another (via tricks like /;/, encoded dots, dual decoding, or mismatched trailing-slash rules).
Why path confusion matters
Security stacks are only as strong as their shared understanding of “what URL is this?” When a reverse proxy allowlists /static/* using one parser and the origin maps /static/../admin or /admin;.css differently, filters lie. Path Confusion is that cross-component disagreement—; matrix quirks, encoded dots, double decoding, and slash normalization—rather than a single buggy ../ join.
It enables broken access control bypasses and helps forced browsing reach blocked panels. Related to—but distinct from—Zip Slip (archive names) and unicode normalization attacks (character forms).
How path confusion bypasses controls
Edge applies a path rule
WAF or proxy allowlists/denylists based on its normalization of the request URI.
Ambiguous encoding is sent
Attacker inserts /;/, %2e%2e, overlong encodings, or mixed separators.
Origin parses differently
Framework router resolves a different effective path than the edge evaluated.
Protected handler runs
Admin or sensitive logic executes despite the “blocked” appearance upstream.
Frequent confusion vectors
Semicolon / matrix params
/admin;bypass=/ or /app;/../admin treated inconsistently by stacks.
Encoded and double-encoded dots
%2e%2e%2f and nested decoding diverge between proxy and app.
Slash and case rules
Trailing slashes, //, \, and case-sensitive vs. insensitive mounts.
Prefix ACL illusions
Allowing /public while ../ or ; tricks map into /admin.
Prevention that works
| Control | Notes |
|---|---|
| Canonicalize once | Normalize and decode at a single trusted gateway; forward canonical paths |
| Reject ambiguity | Hard-fail on unexpected encodings, backslashes, or residual %2e sequences |
| Align proxy and app | Document and test identical normalization; prefer one routing authority |
| Authorize after resolve | Run access checks on the path the framework actually dispatches |
| Avoid naive prefix allows | Do not grant /static/* without confirming .. and ; cannot escape |
| Fuzz the full chain | Test through CDN + proxy + app, not the app alone |
- Map every hop that parses URLs (CDN, WAF, reverse proxy, app router).
- Define one canonicalization policy and enforce it before security decisions.
- Reject requests with ambiguous encodings rather than “best effort” decoding.
- Retest deny rules for /admin with ;, encoded dots, and double encoding.
- Ensure object/file handlers canonicalize before joining roots ([Zip Slip](/glossary/zip-slip) mindset).
- Authorize on resolved routes to prevent [broken access control](/glossary/broken-access-control).
- Include unicode path tricks alongside [unicode normalization attacks](/glossary/unicode-normalization-attack).
- Automate full-chain fuzzing in staging that mirrors production proxies.
The practical takeaway
Path confusion is when two layers disagree on what a path means. Canonicalize once, reject ambiguous encodings, and authorize the path the application actually runs—not the string the WAF thought it saw.
If a blocked /admin becomes reachable via /admin;.js or encoded dots, fix normalization alignment across the entire edge-to-origin chain.
Related security terms
Zip Slip
Archive entry path traversal—related unsafe path trust in another layer.
Forced Browsing
Discovers sensitive paths that confusion tricks may help reach.
Unicode Normalization Attack
Character normalization mismatches that likewise bypass filters.
Broken Access Control
Confused paths often skip authorization on the “real” resource.
Frequently asked questions
What is path confusion in simple terms?
The firewall or proxy thinks you requested /public/ok, but the app treats the same string as /admin/secret because they disagree on semicolons, encoding, or dots.
How is this different from classic path traversal?
Classic traversal focuses on ../ escaping a directory. Path confusion emphasizes inconsistent interpretation across layers—even without leaving a root—so allowlists and authz see the wrong path.
What payloads commonly cause confusion?
/admin;/..;/public, %2e%2e/, double-encoded dots, mixed slash types, trailing-slash vs. not, and matrix parameters that one stack strips and another keeps.
How do reverse proxies contribute?
Proxies may normalize, strip, or map paths before forwarding. If the app re-parses the raw URI differently, ACL decisions made at the edge do not match the controller that runs.
How do you prevent path confusion?
Canonicalize once at a trusted boundary, use the same normalization rules everywhere, reject ambiguous encodings, and authorize on the canonical path the router actually uses.
Is this related to unicode normalization attacks?
Yes in spirit. [Unicode normalization attacks](/glossary/unicode-normalization-attack) confuse filters on characters; path confusion confuses filters on URL structure and encoding.
Where should teams test?
Any reverse-proxy ACL, static-asset map, or WAF rule that allows by prefix—fuzz with ;, encodings, and dot variants aimed at blocked admin or [forced browsing](/glossary/forced-browsing) targets.
References
Explore authoritative guidance and frameworks related to path confusion.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.