Path Traversal (Directory Traversal) Explained

Path traversal, also called directory traversal, lets an attacker read or write files outside the directory an application intended. It shows up wherever a filename or path comes from user input.

How it works

An application serves files based on a parameter:

GET /download?file=report.pdf

The server builds the path:

const p = "/var/app/uploads/" + req.query.file;
res.sendFile(p);

The attacker sends:

GET /download?file=../../../etc/passwd

Each ../ moves up one directory, and the server returns a system file.

What attackers target

• Application configuration files with database credentials.
• Environment files such as .env.
• Source code, revealing further vulnerabilities.
• Cloud credential files.
• SSH keys and logs.

If traversal affects file writes, such as uploads or exports, attackers may overwrite configuration or place executable files, potentially leading to remote code execution.

Common filter bypasses

Naive filters that strip ../ fail against:

• Encoding: %2e%2e%2f, double encoding %252e%252e%252f.
• Nested sequences: ....//, which becomes ../ after one round of stripping.
• Backslashes on Windows: ..\..\.
• Absolute paths: /etc/passwd passed directly.
• Null bytes in older runtimes: ../../etc/passwd%00.pdf.

How to prevent path traversal

1. Do not use user input in file paths. Store files with generated IDs and look them up in a database.

2. If you must, resolve and verify the final path.

const path = require("path");
const base = path.resolve("/var/app/uploads");
const target = path.resolve(base, req.query.file);
if (!target.startsWith(base + path.sep)) return res.sendStatus(400);
res.sendFile(target);

3. Allowlist filenames or characters, for example only letters, numbers, dashes and a known extension.

4. Run with least privilege so the application cannot read sensitive system files.

5. Use object storage with per-object access control instead of the local filesystem for user files.

Archive extraction: Zip Slip

A related bug occurs when extracting ZIP or TAR files. Entries with names like ../../app/config.js can write outside the extraction directory. Always validate each entry's resolved path before writing.

Testing for path traversal

SecurityInfinity agents test file-related parameters with encoding and bypass variations, confirm file access safely, and give the specific fix for the vulnerable handler. Start free.

Frequently asked questions

Is path traversal the same as local file inclusion?

They are related. Local file inclusion goes further by including and sometimes executing the file, commonly in PHP applications.

Can path traversal happen in cloud storage?

Object storage does not have directories in the same way, but key prefixes built from user input can still let users access other users' objects.

How severe is path traversal?

Reading configuration or credential files is typically high or critical, as it often leads to further compromise.