Local file path manipulation (DOM-based)
Summary: PortSwigger describes DOM-based local file path manipulation as a vulnerability that arises when a client-side script reads controllable data from the DOM, such as the URL, and passes it as the filename parameter to a file handling API. An attacker can construct a URL that, when visited by another user, causes that user's browser to open an arbitrary local file, with impact depending on whether the application reads from or writes to the opened file.
Why it matters: If the application reads the opened file, the attacker may retrieve its data; if it writes, the attacker may write to a sensitive file such as an operating system configuration file - and PortSwigger notes static analysis alone can flag false positives, so the finding needs code and execution-path review before you trust it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026