What is path traversal, and how to prevent it?
Summary: Path traversal, also called directory traversal, lets an attacker read arbitrary files on the server running an application, and in some cases write to them to modify application data or behavior and take full control of the server. PortSwigger's example is a shopping application that appends a user-supplied filename to /var/www/images/, so a request using three ../ sequences steps up to the filesystem root and reads /etc/passwd; on Windows both ../ and ..\ are valid traversal sequences.
Key Takeaway: Defenses that strip traversal sequences are routinely bypassed with absolute paths, nested sequences like ....//, URL encoding such as %2e%2e%2f, or a null byte to cut off a required .png extension - which means a filter you believe is blocking ../ may not be blocking anything at all.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026