security security_error ai_generated true

Security: Path traversal attempt detected: ../../../etc/passwd

ID: security/path-traversal-dotdot

Also available as: JSON · Markdown
88%Fix Rate
87%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Path traversal via ../ sequences allows reading files outside intended directory.

generic

Workarounds

  1. 92% success Resolve path and verify it starts with allowed base directory 
    realpath = os.path.realpath(path); assert realpath.startswith(BASE_DIR)
  2. 90% success Use allowlist of valid filenames instead of accepting arbitrary paths 
    Map user input to predefined file identifiers

Dead Ends

Common approaches that don't work:

  1. Block literal ../ string only 85% fail

    Attackers use URL encoding (%2e%2e%2f), double encoding, or OS-specific separators.

  2. Use regex blacklist for dangerous paths 80% fail

    Blacklists are always incomplete - new bypass techniques emerge regularly.