Overview
This lesson brings the path-traversal concept into focus: how untrusted input used in a file path lets an attacker read (or sometimes write) files outside the intended directory. It explains the vulnerability and its impact, defensively.
Learning objectives
- Define path traversal (directory traversal).
- Explain how it escapes the intended directory.
- Describe its potential impact.
Core concept
Path traversal (directory traversal) is a vulnerability where an application uses untrusted input to construct a file path, and the input is able to reference files outside the intended directory — typically using .. sequences (or their encoded forms) to move up the tree. The result is unauthorized reading of files the application never meant to expose, and in some cases writing/overwriting files. It is fundamentally the same root cause as other injection-style flaws: untrusted input crossing a boundary (here, into a file path) without safe handling.
How it works
The application builds a path from a base directory plus user input and accesses the resulting file. If the input can include traversal sequences that survive to path resolution, the resolved path escapes the base directory and points at arbitrary files (limited by the application's file permissions). Reading such files can disclose configuration, credentials, source code, or system files; where the feature writes files, traversal could place or overwrite files in unintended locations. The severity depends on what files are reachable and the process's privileges.
Practical example
A "view log" feature reads a file named by a log parameter from a logs directory. If it does not keep the resolved path within that directory, a crafted value with traversal sequences could cause it to read a sensitive file elsewhere on the system instead of a log — disclosing its contents to the attacker. The intended feature (reading logs) becomes a means to read arbitrary readable files. Proper containment (canonicalize-then-validate, allowlists, safe APIs) prevents the resolved path from leaving the logs directory.
Cybersecurity relevance
Path traversal is a recognized, high-impact vulnerability: it can expose highly sensitive files (application secrets, system configuration) and undermine confidentiality, sometimes enabling further compromise (e.g. reading credentials that unlock other systems). It appears wherever user input influences file access. Testers probe file-path features with traversal sequences (and encoded variants); defenders ensure resolved paths are contained within the intended directory using the module's controls. Its impact and prevalence make it a standard assessment target.
Common mistakes
- Assuming traversal only affects "file download" features — any input-to-path mapping is at risk.
- Focusing on read-only impact and overlooking write/overwrite traversal where applicable.
- Treating traversal as low-severity, underestimating exposure of secrets/system files.
Key takeaways
- Path traversal uses untrusted input in a file path to reference files outside the intended directory (via
../encoded forms), enabling unauthorized reads and sometimes writes. - It shares the injection root cause: untrusted input crossing into a file path without safe handling.
- Impact ranges from disclosing sensitive files (secrets, config, source) to overwriting files, bounded by reachable files and process privileges — a standard assessment target.
Check your understanding
- In one sentence, what is a path-traversal vulnerability?
- What kinds of sensitive files might a successful path-traversal read, and why does that matter?