Path Traversal
Path traversal is a vulnerability where an attacker manipulates a file path (often using ../ sequences) to access files outside the intended directory, exposing configuration, source code, or credentials. It occurs when untrusted input is used to build a filesystem path without proper validation.
Path traversal (directory traversal) lets an attacker read or write files outside the directory an application intends to serve. By inserting relative-path sequences like ../ (or their encoded variants such as %2e%2e%2f), a request for a file can climb up the directory tree to reach targets like /etc/passwd, application config, or secret keys.
The vulnerability arises when user input is concatenated into a file path and passed to the filesystem without canonicalization or bounds checking. Effective defenses resolve the final path to its canonical (absolute, symlink-resolved) form and confirm it still lives under an allowed base directory. Mapping user input to an allowlist of known filenames or opaque identifiers, rather than raw paths, removes the risk entirely.
Tracked as CWE-22 and part of the broader injection/broken-access-control landscape, path traversal can lead to disclosure of sensitive data or, when writable, to overwriting files and remote code execution. Scanners flag file operations whose path derives from tainted input without a containment check.