Directory Traversal (Path Traversal)

Directory traversal, also called path traversal, is a vulnerability in which an application builds a file path from user input without validating it. Sequences such as ../ can then move up the directory tree and reach files the developer never meant to expose.

Why it matters

Servers hold configuration files, keys and logs outside the public folder. If a download or include feature can be steered to them, an outsider may read sensitive data. The flaw is common in features that serve files by name, such as report downloads and image handlers.

Example

A vulnerable endpoint takes a file name and joins it to a base folder:

/download?file=report.pdf

The defensive fix is to resolve the final path, then confirm it still sits inside the intended directory, and to prefer identifiers over file names:

base = Path("/srv/files").resolve()
target = (base / name).resolve()
if base not in target.parents:
    abort(400)

Common mistakes

• Blocking only the literal string ../, which misses encoded variants.
• Validating before decoding the input instead of after.
• Running the application with permissions that read the whole file system.
• Passing user input directly to file functions.

Related

• Least privilege
• File path
• Vulnerability
• Remote code execution

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.