Lab: File path traversal, validation of start of path
Summary: PortSwigger's Web Security Academy lab describes a path traversal vulnerability in the display of product images, where the application transmits the full file path in a request parameter and validates only that the supplied path starts with the expected folder. The solution modifies the filename parameter to /var/www/images/../../../etc/passwd, and the response then contains the contents of the /etc/passwd file.
Key Takeaway: The check only confirms the path begins with the expected folder, so a value that starts correctly and then climbs out with ../ defeats it - a validation pattern that looks like a control but does not stop an attacker from reading files such as /etc/passwd.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026