Path Traversal

Also Known As

TL;DR

Explanation

Path traversal (also called directory traversal) lets attackers read or include arbitrary files on the server by supplying sequences like ../../etc/passwd in a parameter used to build a file path. In PHP, include/require with user-supplied filenames is the classic vector. Mitigation requires resolving the real path with realpath() and asserting it starts with the intended base directory — whitelist known-good filenames where possible.

How It's Exploited

Diagram

flowchart TD
    INPUT2[User input: ../../../etc/passwd] --> APP_READ[App reads<br/>uploads . . / . . / . . /etc/passwd]
    APP_READ --> SECRET[Reads /etc/passwd!]
    subgraph Fix2
        REALPATH2[realpath resolves all .. and symlinks]
        BASEDIR[Check resolved path starts with allowed dir]
        REALPATH2 --> BASEDIR
        BASEDIR -->|outside allowed| REJECT3[Reject - path traversal]
        BASEDIR -->|inside allowed| ALLOW2[Allow access]
    end
style APP_READ fill:#f85149,color:#fff
style SECRET fill:#f85149,color:#fff
style REJECT3 fill:#238636,color:#fff

Common Misconception

Why It Matters

Common Mistakes

• Passing user-supplied filenames to file_get_contents(), readfile(), or fopen() without normalisation.
• Filtering traversal sequences with str_replace('../', '') — bypassed with ....// which collapses to ../.
• Not verifying that the realpath() of the requested file is within the intended directory.
• Allowing the full filesystem path to be specified via a 'file' or 'path' query parameter.

Code Examples

$file = $_GET['file'];
readfile('/var/www/uploads/' . $file);

$base    = realpath('/var/www/uploads');
$requested = realpath($base . '/' . $_GET['file']);

if ($requested === false || !str_starts_with($requested, $base . DIRECTORY_SEPARATOR)) {
    http_response_code(403); exit;
}
readfile($requested);

References

• ↗ https://owasp.org/www-community/attacks/Path_Traversal
• ↗ https://cwe.mitre.org/data/definitions/22.html

Tags

Related Terms