Path Traversal
Also known as Directory Traversal, it is a web vulnerability that allows attackers to access files and directories stored outside the intended directory root of a web application, by manipulating file path inputs, “traversing” the file system, and gaining access to sensitive resources, including configuration files, source code, authentication credentials, or even system binaries.
Common types of Path Traversal are:
Use of escape sequences to reach an intended directory
Encoding traversal sequences to bypass naive filters
Windows-specific traversal where backslashes are used instead of forward slashes
Abusing null bytes on older systems to bypass extension filters
Traversal inside Zip/Tar compressed files containing malicious entries that could overwrite arbitrary files when extracted
Scope
Since the actual traversal happens on the server’s file system, it is a server-side vulnerability that arises from improper handling or sanitization of user-supplied input when building file paths.
This vulnerability often overlaps with Information Disclosure, since its primary purpose is usually to extract sensitive data.
Some common scenarios are in file download portals, image rendering, log viewers, web shells, or misconfigured file upload systems.
Exploitation Techniques
Path Traversal abuses the user input to construct file system paths that are not being sanitized properly, and could bypass filters and specialized libraries.
Reading Arbitrary Files
We could try to read files outside of the location of a resource by modifying the point where these are being called.
We check for parameters in the URL or HTML labels that call the name of a file or its path, and then we try to jump between directories using relative route sequences and read other system files
Bypassing Input Filters
Sometimes, we will need to check the source code (if possible) to look for any input validations that are not efficient and could be bypassed. In this, we can find various cases.
If filtering the
../or..\strings, we could use other combinations to bypass this verification, even when doing replacements
In other cases, the code could only validate files whose name starts with a specific value
Also, when traversing sequences are banned, we can URL encode or even double URL encode the respective characters
If needed to end with an expected file extension, we can use a null byte (
%00) to bypass it
We could also automate the process of finding correct payloads using Burp Suite Intruder, which provides a predefined payload list named Fuzzing - path traversal
Null Byte Poisoning
To bypass input filtering or validation mechanisms in web applications or other systems, we could insert a null byte in URL encoding (%00) or in hexadecimal (\x00) to terminate strings, and provoke validations to misbehave.
When accessing a resource gives us a 403 error, and the site tells us that only certain types or extensions are allowed to be requested, we could use a null byte to bypass these restrictions
We could also URL-encode the
%to bypass some filters
It is also possible to modify the hex data of a request directly and add a null hex byte in the corresponding position of the extension
Impact
Confidentiality breach exposing sensitive system or application files
Integrity risk in special cases where files on the server can be overwritten
Authentication compromise where credentials, tokens, or private keys could be accessed
Exposure of configuration files that could lead to database compromise, lateral movement, or pivoting
Arbitrary code execution when combined with other vulnerabilities like LFI or File Uploads
Mitigation Strategies
Avoid passing user-supplied input to filesystem APIs and manually concatenating paths
Validate the user input before processing it and use whitelists of permitted values
Sanitize input by allowing only expected characters, like alphanumeric, no dots, slashes, or protocols
Reject input containing sequences like
../or encoded equivalents.Ensure proper file path resolution and canonicalize the path (turn relative paths by resolving symbolic links and turning them into their absolute equivalent)
Restrict access so that even if traversal happens, the attacker cannot leave the intended directory.
Run web servers with minimal permissions so sensitive files remain inaccessible.
Only allow specific extensions and check using MIME types, not just string endings
Checklist for Developers and Sysadmins
Last updated