Path Traversal
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path traversal occurs when user input is used to build a file path and sequences such as ../ or absolute paths let the request escape the directory the application intended to use. Attackers read sensitive files such as configuration, credentials, and source code, and where writes are possible they can overwrite files to achieve code execution. Encoding tricks, alternative separators, and archive extraction (zip slip) are common ways around naive filters.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A download endpoint takes ?file=report.pdf and returns /etc/passwd when given ?file=../../../../etc/passwd.
- A filter strips ../ once, so ....// collapses back into ../ after the single pass.
- Extracting an uploaded ZIP whose entries are named ../../app/config.php overwrites application files.
How to mitigate it
- Avoid passing user input to file system APIs; map requests to server-side identifiers or an allow-list of known files.
- If a path must be built, canonicalize it and verify the resolved path still starts with the intended base directory before opening it.
- Validate entry names when extracting archives and reject absolute paths or any entry that resolves outside the target directory.
- Run the service with minimal file system permissions, ideally in a container or chroot with read-only mounts.
Go deeper
Practice this topic
Test your knowledge of Path Traversal with exam-style practice questions.