path-traversal

Path Traversal Detection

Overview

Path traversal is a server-side flaw in which an attacker steers a filesystem path the application builds from request data, escaping the directory the developer intended and reaching arbitrary locations on the host. It sits at the point where a parameter — a query value, form field, JSON property, header, cookie, or an entry name inside an archive — flows into an open, read, write, include, or send-file call. The attacker is usually an unauthenticated or low-privileged remote user supplying separators and .. segments, or an absolute path, to leave the base directory. In the read direction they obtain source code, configuration, database and cloud credentials, private keys, and OS files, which feed further compromise; in the write direction they overwrite configuration, scheduled jobs, or authorised keys, or drop an executable file into a served directory, which usually means code execution. This skill finds such flaws by locating every site where request data reaches a filesystem path, checking each site in parallel, and merging the results into <output_dir>/path-traversal-results.md.

What it is NOT

• File upload flaws (/websec:file-upload): traversal inside an uploaded filename is a real write-direction case and can be reported here, but if the core problem is unvalidated file type, an executable landing in a served directory, or a non-atomic store, that skill owns it. Test: would the flaw disappear if the destination path were containment-checked? If yes it is traversal; if the file would still be dangerous where it legitimately lands, it is an upload flaw.
• Server-side request forgery (/websec:ssrf): the sink decides. A value passed to a network client is that skill's, even with a file: scheme; a value passed to a filesystem API is this one's.
• Access control and object references (/websec:access-control): fetching another user's document by changing an identifier is an authorization failure. It becomes traversal only when the identifier is concatenated into a path and separators or .. change which file is opened.
• Information disclosure (/websec:information-disclosure): a directory listing, a backup file left in the webroot, or a deliberately public file is exposure by configuration. Here the attacker steers the read.
• Template injection (/websec:ssti): controlling a template name that is loaded from disk is traversal; controlling template content that is then evaluated is that skill's.
• XML external entities (/websec:xxe): a path taken from the request and handed to a filesystem API is this class; a path an XML document instructs the parser to open through an entity or SYSTEM declaration is that one. Test: who names the file — the request, or the document being parsed?
• Not a finding: a value that is reduced to a bare basename and matched against an allow-list before use; a path that is canonicalised and confirmed to stay under the base directory before the file is opened; an opaque identifier resolved through a server-side lookup table; a parameter that only echoes a path string into the response without any filesystem call; framework static-file middleware used as designed with no request value passed into a custom path builder.