Path Normalisation Bypass

Also Known As

TL;DR

Explanation

Path normalisation attacks exploit the gap between how an application validates a path and how the OS resolves it. Common techniques: directory traversal (../../etc/passwd), URL-encoded separators (%2F, %5C on Windows), double encoding (%252F), null bytes (file.php%00.jpg in older PHP), and Windows UNC paths. PHP's realpath() resolves symlinks and traversal sequences to a canonical absolute path — always use it to validate that the resolved path starts with the intended base directory. Use basename() when you only need the filename component. Never construct file paths by concatenating user input directly, even after filtering — a filter on ../ is bypassable; a realpath() prefix check is not.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Checking if a path starts with an allowed prefix before calling realpath() — the check is against the un-normalised string.
• Filtering ../ sequences with str_replace() but missing URL-encoded variants %2e%2e%2f.
• Not verifying that realpath() output is still within the intended base directory after resolution.
• Using basename() for security — it strips the path but the remaining filename may still be dangerous.

Code Examples

$file = $_GET['file'];
readfile('/var/www/files/' . $file); // ../../etc/passwd works

$base = realpath('/var/www/files');
$path = realpath($base . '/' . $_GET['file']);
if ($path === false || !str_starts_with($path, $base)) {
    abort(403);
}
readfile($path);

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html

Tags

Related Terms