Directory Traversal (Path Traversal)

Directory traversal, also called path traversal, is a vulnerability in which an application builds a file path from user input without validating it. Sequences such as ../ can then move up the directory tree and reach files the developer never meant to expose.

Why it matters

Servers hold configuration files, keys and logs outside the public folder. If a download or include feature can be steered to them, an outsider may read sensitive data. The flaw is common in features that serve files by name, such as report downloads and image handlers.

Example

A vulnerable endpoint takes a file name and joins it to a base folder:

/download?file=report.pdf

The defensive fix is to resolve the final path, then confirm it still sits inside the intended directory, and to prefer identifiers over file names:

base = Path("/srv/files").resolve()
target = (base / name).resolve()
if base not in target.parents:
    abort(400)

Common mistakes

• Blocking only the literal string ../, which misses encoded variants.
• Validating before decoding the input instead of after.
• Running the application with permissions that read the whole file system.
• Passing user input directly to file functions.

Related

• Least privilege
• File path
• Vulnerability
• Remote code execution

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.