What Is a Path Traversal Attack?
A path traversal attack abuses a file-path parameter to reach files outside the directory an
application intended to serve. By inserting ../ sequences — which mean “go up one directory” — an
attacker walks out of the safe folder and into configuration files, source code, or system files.
It is a classic example of untrusted input reaching a sensitive operation unchecked.
How does the attack work?#
Consider an app that serves files by name:
Intended: GET /download?file=report.pdf → /var/app/files/report.pdf
Attack: GET /download?file=../../../../etc/passwd
→ /etc/passwdEach ../ climbs one level; enough of them escape the base directory entirely. Attackers also
use encoded variants (%2e%2e%2f), absolute paths, and null bytes to slip past naive filters,
which is why blocklisting ../ alone fails.
What does path traversal expose?#
| Target | Impact |
|---|---|
/etc/passwd, system files | Reconnaissance, user enumeration |
App config, .env files | Database credentials, secrets, API keys |
| Source code | Reveals other vulnerabilities |
| Logs | Session tokens, sensitive data |
Combined with a file write primitive, traversal can escalate from reading to code execution.
How do you prevent it?#
Stop deriving file paths from raw input:
- Map identifiers to files server-side — the user picks an ID, never a path.
- Canonicalize and verify — resolve the final path and confirm it starts with the intended base directory.
- Run with least privilege — the process should not be able to read sensitive files at all.
Path traversal is an input-validation and access failure. It often accompanies file upload flaws. More at the Web Security hub.
Frequently asked questions#
What is a path traversal vulnerability?
Path traversal (or directory traversal) lets an attacker access files outside the intended directory by manipulating a file path parameter, typically with ../ sequences that walk up the directory tree. If an app builds a file path from user input without validation, an attacker can read configuration, source code, or system files like /etc/passwd.
How do you prevent path traversal?
Do not build file paths from raw user input. Prefer an allowlist of permitted files or opaque identifiers mapped server-side to real paths. If you must use a supplied name, canonicalize the resolved path and verify it stays within the intended base directory before opening it. Sanitizing ../ alone is not enough — attackers use encodings.