Path Traversal

What Is Path Traversal#

Path traversal — also called directory traversal or dot-dot-slash attack — is a vulnerability that allows an attacker to read, and sometimes write, files outside the directory an application intended to expose. Classified as CWE-22 under OWASP A01:2021 (Broken Access Control), the attack exploits insufficient validation of user-supplied path components: an attacker inserts ../ sequences that navigate upward in the directory tree beyond the allowed root.

The vulnerability appears wherever an application constructs a file path from user input without resolving and validating the result against a known-safe base: file download endpoints (?file=report.pdf), template loaders (?page=welcome), image servers, log viewers, plugin installers, and archive extractors. In closed-source projects, Aikido research tracked an 85% increase in path traversal prevalence between 2023 and 2024 (1.9% to 3.5% of all findings). CVE-2024-23897 (Jenkins, CVSS 9.8) was weaponized within days of disclosure; CVE-2024-4577 (PHP-CGI) within 48 hours — both added to the CISA KEV catalog.

Path traversal vs. related vulnerabilities:

• LFI (Local File Inclusion, CWE-98): PHP-specific variant where user input reaches include() or require() — enables both file read and code execution via PHP wrappers. Every LFI is a path traversal; not every path traversal is an LFI.
• RFI (Remote File Inclusion): User input reaches include() with allow_url_include=On and points to a remote URL — effectively SSRF at the PHP layer.
• SSRF: The server's own network stack is weaponized to make outbound requests to internal infrastructure — no filesystem traversal involved.

Mechanism#

The attack exploits how servers construct file paths by concatenating a base directory with user-supplied input. Without canonicalization, ../ sequences traverse upward in the directory tree before the filesystem resolves the final path.

Four conditions that enable the attack:

1. The application accepts a filename or path component from user input.
2. The input is concatenated with a base directory without canonicalization.
3. No allowlist check verifies the resolved path remains inside the base directory.
4. The web server process has read (or write) access to the target file.

Concrete HTTP example — unauthenticated file read:

GET /api/reports/download?file=../../../../etc/passwd HTTP/1.1
Host: target.example.com

Response body:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

The application constructed /var/www/app/reports/../../../../etc/passwd, which the OS resolved to /etc/passwd. Four ../ hops: reports/ → app/ → www/ → var/ → filesystem root.

Attack Variants#

Modern Attack Surface 2024-2026#

ZIP Slip / Tar Slip#

ZIP Slip is a path traversal variant triggered during archive extraction. A malicious archive contains entries with traversal sequences in their filenames:

Archive contents:
  ../../var/www/html/webshell.php
  ../../etc/cron.d/backdoor

When the application extracts the archive without validating each entry's resolved path, files land in attacker-controlled locations outside the intended extraction directory. The primitive achieves arbitrary file write — frequently chained to RCE by overwriting a web-accessible PHP, ASPX, or JSP file.

Secure extraction (Python):

import zipfile, os
 
def safe_extract(zip_path: str, dest_dir: str) -> None:
    dest_dir = os.path.realpath(dest_dir)
    with zipfile.ZipFile(zip_path) as zf:
        for member in zf.namelist():
            target = os.path.realpath(os.path.join(dest_dir, member))
            if not target.startswith(dest_dir + os.sep):
                raise ValueError(f"ZIP Slip detected: {member}")
            zf.extract(member, dest_dir)

CVE-2024-1708 (ConnectWise ScreenConnect) achieved unauthenticated RCE via ZIP Slip chained with an authentication bypass — exploited by multiple threat actor groups within 24 hours of disclosure.

LFI to RCE via Log Poisoning#

Log poisoning escalates a read-only path traversal to full code execution in two steps:

Step 1 — Poison the Apache access log:

GET / HTTP/1.1
Host: target.com
User-Agent: <?php system($_GET['cmd']); ?>

Apache writes the User-Agent value verbatim into /var/log/apache2/access.log. The PHP code is now stored on disk.

Step 2 — Include the log via LFI:

GET /view?page=../../../var/log/apache2/access.log&cmd=id HTTP/1.1
Host: target.com

PHP interprets the stored code and returns uid=33(www-data). Other poisonable log files include /var/log/nginx/access.log, /var/log/auth.log (via SSH login with a malicious username), and /proc/self/fd/2 (process stderr, bypasses permission restrictions).

PHP Wrappers (php://filter, phar://)#

PHP stream wrappers transform file paths into executable primitives:

# Source code disclosure — base64-encode any PHP file without executing it
php://filter/convert.base64-encode/resource=index.php
 
# Filter chain RCE (Synacktiv 2022+) — generates arbitrary PHP without file upload
php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|...(chain)
 
# PHAR deserialization — any file operation on phar:// triggers gadget chain
phar:///tmp/upload.jpg  (file contains valid PHAR metadata with RCE gadget)

realpath() returns false for wrapper URIs (they are not real filesystem paths), so a correct canonical-path check automatically blocks all PHP wrapper exploitation.

Client-Side Path Traversal (CSPT)#

CSPT is a browser-side variant in which a Single Page Application constructs API endpoint URLs from user-controlled path segments. Unlike server-side path traversal, no filesystem is involved — the traversal redirects the API call to an unintended internal endpoint.

Attack pattern:

Normal SPA URL:  /app/projects/123/settings
Injected URL:    /app/projects/123%2F..%2F..%2Fadmin/settings
SPA constructs:  GET /api/projects/123/../../../admin/settings
                 → resolves to GET /api/admin/settings (bypasses access control)

The Meta 2025 bug bounty paid $111,750 for a path traversal chain leading to RCE. CVE-2025-6023 (Grafana) demonstrates CSPT chained with an open redirect and XSS to achieve account takeover. Defense: sanitize all URL path segments before using them in client-side API calls; never pass raw window.location.pathname components into fetch URLs.

Container Escape via Path Traversal (CVE-2024-21626)#

The runc "Leaky Vessels" vulnerability (CVSS 8.6) demonstrates path traversal escaping container isolation entirely. runc leaks an open file descriptor referencing the host's working directory before pivot_root is called. Setting process.cwd to /proc/self/fd/7 in a container's config resolves the container's working directory against the host filesystem:

# Malicious Dockerfile — triggers CVE-2024-21626
FROM ubuntu
WORKDIR /proc/self/fd/7

Executing processes with paths relative to this leaked CWD accesses host files directly. Impact: full container escape — read/write host filesystem, steal Kubernetes service account tokens, full cloud environment compromise. Patched in runc 1.1.12, Docker 25.0.2, containerd 1.7.13.

Apache mod_rewrite Confusion (Orange Tsai, DEF CON 32)#

Orange Tsai's 2024 research documented 9 CVEs and 20 exploitation techniques in Apache HTTP Server's path handling. CVE-2024-38474 (CVSS 9.1): encoded question marks (%3F) in mod_rewrite backreferences cause path truncation, allowing escape from the document root and potential RCE via script execution. CVE-2024-38472: UNC path coercion on Windows via %5C%5Cattacker-server/path triggers SSRF through apr_filepath_merge(). Patched in Apache 2.4.60 (July 2024).

Real-World CVEs#

Encoding Bypasses#

Input validation filters operating on the raw string before filesystem resolution are bypassed by any encoding that produces the same byte sequence after the filesystem's own normalization:

Detection#

Manual Testing#

1. Identify file-serving parameters: file=, path=, page=, template=, include=, doc=, resource=, lang=, theme=, layout=, attachment=, export=.
2. Submit a basic traversal: ../../../../etc/passwd (Linux) or ..\..\..\windows\win.ini (Windows). Confirm with file-specific markers.
3. Try encoding variants if filtered: %2e%2e%2f, ..%2f, %252e%252e%252f, ....//, ..%c0%af.
4. Test absolute path injection: ?file=/etc/passwd — Python os.path.join(base, "/etc/passwd") returns /etc/passwd; the base is discarded for absolute inputs.
5. Test PHP wrappers (if PHP detected): php://filter/convert.base64-encode/resource=index.php — base64-decode the response to recover source code.
6. Test log poisoning (if LFI confirmed): verify access to /var/log/apache2/access.log via traversal, then inject <?php system($_GET['cmd']); ?> as User-Agent.
7. Test archive upload endpoints for ZIP Slip: create a malicious archive with ../../evil.txt entries using evilarc or zip-slip-vulnerability tooling.

Automated Detection#

• dotdotpwn: dedicated path traversal fuzzer with 10 traversal modules across HTTP, FTP, TFTP
• ffuf: fast fuzzer paired with SecLists/Fuzzing/LFI/LFI-Jhaddix.txt wordlist
• Nuclei: community templates with tags lfi, traversal, local-file-read
• Burp Suite Pro: active scanner + manual Intruder with traversal payloads

BreachVex detection: template-based scanning, parameter fuzzing, direct HTTP probing with 19+ payload variants, and an extended LFI prover covering PHP wrappers. A finding reaches confirmed status only when three gates pass: HTTP 200, content length ≥ 10 bytes, and a content marker matching the target file (e.g., root:x:[0-9]+:[0-9]+: for /etc/passwd). PHP filter responses are base64-decoded before marker matching. Fuzzing-only hits without direct confirmation are downgraded to low-severity potential findings to suppress false positives.

Key confirmation markers:

/etc/passwd         →  root:x:0:0:, /bin/bash, nologin
/proc/self/environ  →  PATH=, HOME=, USER=, AWS_SECRET_ACCESS_KEY=
WEB-INF/web.xml     →  <web-app
~/.aws/credentials  →  [default], aws_access_key_id=
C:\Windows\win.ini  →  [fonts], [extensions]

Prevention#

1. Canonical Path Validation (Primary Defense)#

Resolve the full path with realpath() / getCanonicalPath() after joining with the base directory, then assert the result starts with the base directory followed by a path separator. The separator suffix is critical — without it, /uploads_backup passes a startsWith('/uploads') check.

Python:

import os
 
BASE_DIR = os.path.realpath("/var/www/app/uploads")
 
def safe_open(filename: str):
    # realpath resolves symlinks, normalizes .., decodes percent-encoding
    requested = os.path.realpath(os.path.join(BASE_DIR, filename))
    if not requested.startswith(BASE_DIR + os.sep):
        raise ValueError("Path traversal detected")
    return open(requested, "rb")

Node.js:

const path = require("path");
const fs = require("fs");
 
const BASE = fs.realpathSync("/var/www/app/uploads");
 
function safeRead(userInput) {
  const resolved = path.resolve(BASE, userInput);
  const real = fs.realpathSync(resolved);  // follows symlinks
  if (!real.startsWith(BASE + path.sep)) {
    throw new Error("Path traversal blocked");
  }
  return fs.readFileSync(real);
}

Java:

File base = new File("/var/www/app/uploads").getCanonicalFile();
File requested = new File(base, userInput).getCanonicalFile();
// getCanonicalPath resolves .., symlinks, and OS normalization
if (!requested.toPath().startsWith(base.toPath())) {
    throw new SecurityException("Path traversal attempt");
}

PHP:

<?php
$base = realpath('/var/www/uploads');
$requested = realpath($base . DIRECTORY_SEPARATOR . $_GET['file']);
// realpath() returns false for non-existent paths AND for php:// wrappers
if ($requested === false || strpos($requested, $base . DIRECTORY_SEPARATOR) !== 0) {
    http_response_code(403);
    exit('Forbidden');
}
echo file_get_contents($requested);

Go:

import (
    "net/http"
    "os"
    "path/filepath"
    "strings"
)
 
const BASE = "/var/www/uploads"
 
func safeDownload(w http.ResponseWriter, r *http.Request) {
    clean := filepath.Clean(r.URL.Query().Get("file"))
    full := filepath.Join(BASE, clean)
    if !strings.HasPrefix(full, BASE+string(filepath.Separator)) {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    http.ServeFile(w, r, full)
}

2. Indirect File References (Eliminate User-Controlled Paths)#

Never pass user input directly to filesystem functions. Store files under UUIDs and resolve the real path server-side:

# Safe: user supplies an opaque ID, never a filename
record = db.query(File).filter_by(id=file_id, owner=current_user).first()
if not record:
    raise HTTPException(status_code=404)
return send_file(record.storage_path)  # internal path, never user-controlled

3. OS-Level Containment#

Run file-serving processes inside a chroot jail or container with no access to sensitive system paths. Even a successful traversal cannot reach /etc/passwd if the process's filesystem root is the application directory. Combine with seccomp / AppArmor / SELinux mandatory access control policies.

4. PHP-Specific Hardening#

; php.ini
allow_url_fopen  = Off   ; blocks file:// and http:// in include()
allow_url_include = Off  ; required for data:// and phar:// wrapper attacks
open_basedir     = /var/www/app  ; restricts all filesystem access to this prefix

open_basedir enforces a kernel-level path restriction that blocks traversal even if application-level checks are bypassed.

5. Secure Archive Extraction#

Always validate each archive entry's resolved path before extraction. Reject entries with absolute paths or symlinks pointing outside the destination directory. Never extract directly to a web-accessible directory without validation.

Why Blacklist Filtering Fails#

Frequently Asked Questions#

What is path traversal? Path traversal (CWE-22) is a vulnerability where insufficient validation of user-supplied file path components allows ../ sequences to escape the intended base directory, exposing arbitrary server files — /etc/passwd, SSH private keys, .env secrets, Kubernetes tokens. In PHP applications, it escalates to RCE via PHP wrappers or log poisoning. Classified under OWASP A01:2021 Broken Access Control.

What is the difference between path traversal and LFI? Path traversal describes escaping the intended directory. Local File Inclusion (LFI, CWE-98) is the PHP-specific case where user input reaches include() or require(), enabling PHP wrapper exploitation and code execution. Every LFI is a path traversal; not every path traversal is an LFI.

What is ZIP Slip? ZIP Slip is a path traversal variant in archive extraction: a malicious archive contains entries with ../../ traversal sequences that cause files to land outside the intended extraction directory, enabling arbitrary file write and RCE. CVE-2024-1708 (ScreenConnect, CISA KEV) exploited it within 24 hours of disclosure.

What is CSPT? Client-Side Path Traversal (CSPT) occurs when a SPA constructs API URLs from user-controlled path segments. Injecting ../ redirects the API call to an unintended endpoint — bypassing access controls or chaining to XSS. The Meta 2025 bug bounty paid $111,750 for a CSPT chain.

Why does blacklist filtering fail? The encoding space is unbounded: ....//, %252e, %c0%af, %ef%bc%8f, Unicode normalization variants, and nested sequences all produce the same filesystem operation after OS-level normalization. The only reliable defense is canonical path resolution (realpath() / getCanonicalPath()) followed by an allowlist check.

How do I prevent path traversal in Python? os.path.realpath(os.path.join(BASE_DIR, user_input)) then assert the result startsWith(BASE_DIR + os.sep). Never use os.path.join() alone — os.path.join('/uploads/', '/etc/passwd') returns /etc/passwd because an absolute second argument replaces the base.

What files should I test for first? /etc/passwd (confirm traversal), /proc/self/environ (often contains cloud credentials), ~/.ssh/id_rsa, ~/.aws/credentials, /var/run/secrets/kubernetes.io/serviceaccount/token, WEB-INF/web.xml (Java), web.config (IIS), /.env.

What is the CVSS score for path traversal? Typical read-only traversal: CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Write-capable variants (ZIP Slip, log poisoning): 8.4-9.8. CVE-2023-2825 (GitLab) scored 10.0 Critical; CVE-2024-23897 (Jenkins) scored 9.8 Critical with active KEV exploitation.

Resources#

• PortSwigger Web Security Academy — Path Traversal
• OWASP Path Traversal
• Orange Tsai — Apache HTTP Server Confusion Attacks (DEF CON 32)
• Snyk — ZIP Slip Vulnerability Research