Local file path manipulation (reflected DOM-based)
Summary: Reflected DOM-based local file path manipulation occurs when a script uses controllable data as the filename parameter to a file handling API, and an attacker can construct a URL that causes another user's browser to open an arbitrary local file. PortSwigger notes the impact depends on how the application uses the opened file: it may allow the attacker to retrieve file data if the application reads from it, or to write specific data to a sensitive file such as an operating system configuration file if the application writes to it.
What you should know: A crafted URL that makes a user's browser open an arbitrary local file turns a single click into potential read or write access to files on that user's machine, including operating system configuration files. PortSwigger also warns that static analysis alone can flag false positives, so a finding without dynamic evidence needs code and execution-path review before you treat it as exploitable.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026