Question 1

What is path traversal?

Accepted Answer

Path traversal (directory traversal) exploits insufficient input validation to access files outside the intended directory. By injecting ../ sequences into file path parameters, attackers can read sensitive files like /etc/passwd, configuration files, source code, or environment variables.

Question 2

How do I prevent path traversal?

Accepted Answer

Use path.basename() to strip directory components from user input, validate that the resolved path starts with the expected directory (chroot-style check), use an allowlist of permitted filenames, and never pass user input directly to file system APIs.

Path Traversal

Challenges

Frequently Asked Questions