Path Traversal

What it is

Path traversal (also known as directory traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server by inserting ../ sequences into file path parameters. This can expose application code, credentials, system configuration files, and sensitive operating system files.

Attack Vectors

• File download functionality with a filename parameter
• File upload functionality with path components
• Template inclusion parameters
• Image and document display features
• Static resource serving with user-controlled paths

Testing Methodology

1. Submit ../etc/passwd in file path parameters
2. Try URL-encoded variants: %2e%2e%2fetc%2fpasswd
3. Test double-encoded: %252e%252e%252fetc%252fpasswd
4. Test Windows paths: ..\..\windows\win.ini
5. Try null byte injection: ../etc/passwd%00.jpg to bypass extension checks

Indicators of Vulnerability

• /etc/passwd contents or Windows win.ini in response
• Application reads a different file than expected
• Error messages revealing file system paths

Detection Guidance

Monitor for ../ sequences in file path parameters. Log file access attempts. Alert on access to sensitive paths like /etc/passwd or system directories.

Mitigation & Remediation

• Validate file paths against an allowlist of permitted directories
• Use realpath() or equivalent to resolve the canonical path and verify it starts within the allowed directory
• Avoid using user input to construct file system paths
• Apply principle of least privilege to file system access

References

• PortSwigger Path Traversal
• OWASP Path Traversal
• OWASP Hunting — Path Traversal (upstream)