Path Traversal

Definition

../ sequences access files outside intended directory.

Root cause

Using user input in file paths.

Affected components

• Components in the “File Access” class
• Application / API handlers
• Supporting libraries

Impact

Reading sensitive files.

Severity

High

Safe lab reproduction

PortSwigger path traversal labs

Detection methodology

Logs containing ../ or encoded variants.

Evidence examples

• Lab reproduction notes: PortSwigger path traversal labs
• Request/response excerpts (redacted)
• Detection signal: Logs containing

Remediation

Canonicalize paths and enforce a base directory.

Secure coding examples

Map IDs to files instead of accepting filenames.