Verity Ultraseek before 5.2.2 allows remote attackers to obtain the full pathname of the document root via an MS-DOS device name in the web search option such as (1) NUL (2) CON (3) AUX (4) COM1 (5) COM2 and others.