Path Traversal
HighPath Traversal / Directory Traversal
Definition
Path Traversal is a vulnerability that lets an attacker access files and directories outside the application's root directory using sequences like ../. The attacker can read sensitive operating-system files, the application's source code or configuration files containing credentials.
Impact
Reading sensitive system files (/etc/passwd, /etc/shadow)Access to source code and configuration filesObtaining database and API credentialsCombined with upload, possible remote code execution
Examples
Basic Path Traversal
Using ../ sequences the attacker climbs levels in the filesystem until reaching the root and accessing system files. The bypasses use double encoding or alternative sequences when filters are present.
# Legitimate request GET /api/files?name=report.pdf # Path Traversal attack GET /api/files?name=../../../etc/passwd # Common filter bypasses GET /api/files?name=....//....//....//etc/passwd GET /api/files?name=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd GET /api/files?name=..%252f..%252f..%252fetc%252fpasswd