security file_security ai_generated true

Path traversal — ../ sequences bypass file access control

ID: security/path-traversal-dotdot-normalization

Also available as: JSON · Markdown
90%Fix Rate
92%Confidence
4Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

User input containing ../ allows access to files outside the intended directory.

generic

Workarounds

  1. 93% success Resolve the full canonical path and verify it is within the allowed directory 
    real = os.path.realpath(os.path.join(base, user_input)); assert real.startswith(os.path.realpath(base))

    Sources: https://owasp.org/www-community/attacks/Path_Traversal

  2. 90% success Use a whitelist of allowed filenames 
    allowed = {'report.pdf': '/data/reports/report.pdf'}; path = allowed.get(user_input)

    Sources: https://owasp.org/www-community/attacks/Path_Traversal

Dead Ends

Common approaches that don't work:

  1. Filter out ../ with string replace 90% fail

    Attackers use URL encoding, double encoding, or OS-specific separators to bypass

  2. Check if path starts with allowed directory using startswith 80% fail

    Path may resolve differently after symlink resolution