Lab: File path traversal, traversal sequences stripped non-recursively
Summary: This PortSwigger Web Security Academy lab presents a path traversal vulnerability in the display of product images, where the application strips path traversal sequences from the user-supplied filename before using it. The solution modifies the filename parameter to the value ....//....//....//etc/passwd, and the response then contains the contents of the /etc/passwd file.
Why it matters: The filter removes traversal sequences only once and non-recursively, so a nested payload like ....// survives the strip and reassembles into ../ - meaning a single-pass sanitizer can still hand an attacker the contents of /etc/passwd.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026