Path Traversal — Overview

What is Path Traversal#

Path traversal (CWE-22) is a vulnerability in which an application constructs a filesystem path from user-controlled input without adequately constraining where that path can resolve. The attacker inserts ../ sequences — or their encoded equivalents — to navigate upward past the intended base directory, reaching files the application never intended to expose. Under OWASP A01:2021 (Broken Access Control), it represents a failure to enforce least privilege at the filesystem level.

The vulnerability appears wherever server-side code constructs a path from external input: file download endpoints, template loaders, image servers, log viewers, document generators, and plugin installers. An 85% year-over-year increase in closed-source project prevalence (1.9% to 3.5% of all findings) from Aikido's 2024 analysis shows the attack surface is growing. Multiple CISA KEV entries in 2024 confirm active exploitation at scale.

Path traversal is distinct from SSRF, which manipulates URL resolution to reach internal network services. The two primitives sometimes combine: urllib.parse.urljoin(base, "/etc/passwd") silently ignores the base when the user input begins with /, creating a path traversal primitive inside URL-fetching code (CVE-2026-32871, FastMCP, CVSS 9.8).

How It Works#

The vulnerability has a single structural root cause: an application concatenates a fixed base directory with user input and passes the result to a filesystem function without first verifying that the resolved canonical path remains within the base.

Five exploitation steps:

1. Attacker identifies a parameter feeding a filesystem operation: file=, path=, template=, page=, include=, doc=, resource=.
2. Attacker submits a traversal sequence targeting a high-value file (../../etc/passwd).
3. Application concatenates the base directory with the input without canonical validation.
4. The OS resolves .. segments, escaping the intended directory.
5. The filesystem returns the target file; the application returns its contents in the HTTP response.

Confirmation markers differ by target. /etc/passwd returns lines matching root:x:0:0:. /proc/self/environ exposes runtime environment variables that frequently contain AWS_SECRET_ACCESS_KEY, DATABASE_URL, and API_KEY values. WEB-INF/web.xml returns XML containing <web-app.

Attack Variants#

LFI to RCE Escalation Chains#

Three escalation chains consistently convert path traversal reads into remote code execution:

Log poisoning: Inject PHP code into server access logs via a crafted User-Agent: <?php system($_GET['cmd']); ?> request. When the log file is subsequently included via LFI, the PHP interpreter executes the injected payload. Target logs: /var/log/apache2/access.log, /var/log/nginx/access.log, /var/log/auth.log, /proc/self/fd/2.

PHP filter chains: php://filter/convert.base64-encode/resource=index.php returns base64-encoded PHP source code without requiring any write access. Advanced filter chain techniques (Charles Fol's php_filter_chain_generator) construct arbitrary PHP payloads targeting /dev/null, achieving unauthenticated RCE from LFI with no file upload required.

ZIP Slip: Malicious archives contain entries with traversal sequences in filenames (../../var/www/html/shell.php). Naive extraction writes the webshell into the document root. CVE-2024-1708 (ConnectWise ScreenConnect, CVSS 8.4) chained with auth bypass CVE-2024-1709 (CVSS 10.0) to achieve unauthenticated RCE as SYSTEM within 24 hours of disclosure.

Real-World Examples#

CVE-2024-23897 — Jenkins CLI Parser (CVSS 9.8, CISA KEV): The args4j library's expandAtFiles() replaced @/path/to/file tokens in CLI commands with file contents. Unauthenticated attackers read /var/jenkins_home/secrets/master.key and /etc/passwd via HTTP, WebSocket, or SSH. Exploited by the RansomEXX group to compromise India's National Payments Corporation, shutting down 300+ banks. CISA mandatory patch deadline: September 9, 2024.

CVE-2024-1708 — ConnectWise ScreenConnect ZIP Slip (CVSS 8.4): Combined with auth bypass CVE-2024-1709 (CVSS 10.0), this allowed unauthenticated attackers to write arbitrary ASPX webshells to the ScreenConnect web root. Multiple ransomware groups weaponized the chain within 24 hours of disclosure, achieving SYSTEM access.

CVE-2023-2825 — GitLab Unauthenticated Path Traversal (CVSS 10.0): Arbitrary file read via path traversal in public nested project URL handling in GitLab CE/EE. No authentication required. Exposed /etc/passwd, SSH private keys, and GitLab runner registration tokens.

Detection#

Manual Testing#

1. Identify all parameters that appear to reference files: file=, path=, page=, template=, include=, doc=, resource=, lang=, layout=, theme=, download=.
2. Submit ../../etc/passwd (Linux) or ..\..\Windows\win.ini (Windows) and examine the response body for confirmation markers.
3. If the initial payload is filtered, test encoded variants: ..%2f..%2fetc%2fpasswd, %2e%2e%2f%2e%2e%2fetc%2fpasswd, ..%252f..%252fetc%252fpasswd.
4. Test absolute path injection without traversal sequences: /etc/passwd directly.
5. Add a null byte suffix: ../../etc/passwd%00.txt — if the response differs, a null byte bypass is present.
6. For Java applications, test ../WEB-INF/web.xml — marker is <web-app.
7. Confirm with marker search in response body: root:x:0:0: (passwd), [fonts] (win.ini), <web-app (web.xml).

Automated Detection#

BreachVex detects path traversal through multiple complementary techniques: template-based scanning with lfi/traversal templates, parameter fuzzing across a tiered set of LFI-prone parameter names, direct HTTP verification with 22 payload variants against OS-specific content markers, and an extended LFI prover with a three-criterion content gate (HTTP 200 + body length ≥ 10 bytes + marker regex match). Fuzzing hits without content-gate confirmation are demoted to low-severity potential findings to suppress false positives.

Prevention#

Canonical Path Validation (Primary Defense)#

import os
 
BASE_DIR = os.path.realpath("/var/www/app/uploads")
 
def safe_open(filename: str):
    # realpath resolves all .., symlinks, and percent-encoding
    requested = os.path.realpath(os.path.join(BASE_DIR, filename))
    # Trailing sep prevents /uploads_backup passing the /uploads check
    if not requested.startswith(BASE_DIR + os.sep):
        raise ValueError("Path traversal attempt blocked")
    return open(requested, "rb")

// Java — getCanonicalFile resolves .. and symlinks
File base = new File("/app/uploads").getCanonicalFile();
File requested = new File(base, userInput).getCanonicalFile();
if (!requested.toPath().startsWith(base.toPath())) {
    throw new SecurityException("Path traversal attempt blocked");
}

Avoid User-Controlled Filenames#

The most robust defense eliminates user-controlled filenames entirely. Map opaque identifiers to real file paths in server-side code:

DOCUMENT_MAP = {
    "q1_report": "/app/reports/2025_q1.pdf",
    "q2_report": "/app/reports/2025_q2.pdf",
}
 
def get_document(key: str):
    path = DOCUMENT_MAP.get(key)
    if path is None:
        raise ValueError("Unknown document key")
    return open(path, "rb")

OS-Level Containment#

Deploy chroot jails, AppArmor/SELinux mandatory access control, or read-only container filesystems to limit blast radius. Even when path validation fails, a properly contained process cannot access files outside its restricted filesystem view.

Resources#

• Path Traversal — Pillar Overview
• PortSwigger: File Path Traversal
• OWASP Path Traversal
• CWE-22: Improper Limitation of Pathname

Related Topics#

• Basic Path Traversal: classic ../ sequences, Linux file targets, and the LFI-to-RCE log poisoning chain.
• Encoded Path Traversal: URL encoding, double encoding, Unicode overlong, and WAF bypass ordering.
• Absolute Path Injection: direct /etc/passwd payloads and Python os.path.join behavior.
• Null Byte Injection: %00 extension filter bypass in PHP, Java, and Go.
• Windows Path Traversal: ..\, UNC paths, Alternate Data Streams, and CVE-2024-4577.
• SSRF: path traversal and SSRF combine when user-supplied paths reach URL-fetching code via file:// or urljoin quirks.