Directory Traversal
What is Directory Traversal?
Directory traversal is a vulnerability in which an attacker manipulates file path input so an application accesses files or directories outside the intended location.
Examples
- A web application meant to display files from one upload folder is tricked into reading a sensitive system file elsewhere on the server.
- An attacker alters a download request so the application returns a configuration file instead of the public document that was supposed to be available.
Discover 🔎
Applications often need to work with files. They may display images, deliver downloads, load templates, read documents, or process uploaded content. That is normal. The problem begins when the application lets the user influence the file path without controlling where that path is allowed to go.
Directory traversal matters because it turns a simple file request into a path outside the part of the system the user was supposed to reach. Instead of staying inside the intended folder, the application can be pushed toward parent directories and unrelated files that were never meant to be exposed.
Summary 📝
Directory traversal is a vulnerability caused by unsafe handling of user-controlled file paths. It allows an attacker to escape the intended directory and access files or locations elsewhere on the server. The risk can range from information disclosure to broader application compromise, depending on what the application can reach. Strong prevention comes from keeping filesystem paths under server-side control, validating resolved paths properly, and limiting file permissions.
Tip: The interactive version includes progress tracking, decks, and premium deep dives.