微软IIS 4.0和5.0都存在利用扩展UNICODE字符取代"/"和"\"而能利用"../"目录遍历的漏洞。未经授权的用户可能利用IUSR_machinename账号的上下文空间访问任何已知的文件。该账号在默认情况下属于Everyone和Users组的成员，因此任何与Web根目录在同一逻辑驱动器上的能被这些用户组访问的文件都能被删除，修改或执行，就如同一个用户成功登陆所能完成的一样。-Microsoft IIS 4.0 and 5.0 are present using the extended UNICODE character to replace the " /"　and " \"　and can use " ../"　directory traversal vulnerability. Unauthorized users may use IUSR_machinename account the context of the space access any known file. By default, the account belongs to Everyone and Users group, so any Web root directory on the same logical drive can be user groups to access these files can be deleted, modified or enforced, just as a user successfully landed on the can do the same.