Lab: File path traversal, traversal sequences stripped with superfluous URL-decode
Summary: This PortSwigger Web Security Academy lab presents a product-image display with a path traversal vulnerability: the application blocks input containing traversal sequences, then URL-decodes the input before using it. The solution is to intercept a product image request in Burp Suite and set the filename parameter to ..%252f..%252f..%252fetc/passwd, which returns the contents of the /etc/passwd file.
What you should know: The filter checks the input before a second decode pass, so a double-encoded sequence like %252f passes the blocklist and becomes a working slash afterward - a reminder that validating data before the last decoding step leaves the check looking at a different string than the one the filesystem sees.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026