Path Traversal
Path traversal escapes an intended directory with crafted relative segments — dot-dot sequences and absolute paths — reading or writing files outside the allowed root.
Definition
Path traversal is a file access flaw where input containing navigation segments resolves outside the sanctioned base directory. Encoded dot-dot sequences, symlinked intermediates, and absolute or UNC-style paths defeat naive concatenation. Canonicalize the resolved path, then verify it is contained within the allowed root before any filesystem operation.
Context and scope
Found in file download endpoints, upload storage, template rendering, archive extraction, and static file servers. Zip-slip is the archive-extraction variant.
Common misconceptions
- Stripping ../ from input is sufficient — encoding and nested encodings reconstruct the sequence after one naive pass
- The framework static handler is safe — custom download endpoints and template paths frequently reintroduce concatenation
- It only reads files — write variants modify configuration, cron jobs, and ssh keys, escalating to code execution
Anti-patterns
- Joining a user filename directly onto an uploads directory and serving whatever resolves
- Extracting archives without checking member paths, letting entries write outside the target directory
- Comparing path prefixes as strings instead of canonicalized path containment
Related concepts
Related examples
Authoritative source
What it is
Filesystem paths are relative to some root the application intends. Traversal input changes the effective root: ../../etc/passwd walks out. The bug is trusting string concatenation where the operating system resolves navigation first.
How it works
Attacks use dot-dot segments, percent or unicode encodings that decode after validation, absolute paths that ignore the base entirely, and symlinks placed inside the allowed tree that point outside. Robust checks resolve the full path with realpath, then assert it begins with the canonical root path plus a separator, rejecting the root itself when it must be a file.
When to apply
Every endpoint that accepts a filename, path, or archive member: downloads, avatars, document generation, plugin loading. Generate filenames server-side from ids where possible and treat client-supplied names as labels, never locations.
Pitfalls
Prefix comparison without separator lets safe_dir-evil pass as inside safe_dir. Symlinks inside the tree can be created by upload or extraction and then followed by later requests — restrict extraction to a jail without following links. Windows adds alternate data streams and reserved device names to the arsenal.