Requested filename string
DevOps & Tooling / Knowledge library
Path Traversal
Uses crafted path segments to escape an intended filesystem directory
Why learn Path Traversal?
Understanding it guides canonicalization and allowlisted file selection
The problem it solves
It prevents untrusted paths from reading or overwriting unrelated files
Where it came from
Path Traversal is a security concept that uses crafted path segments to escape an intended filesystem directory. Its guarantees and tradeoffs depend on the concrete implementation and operating context.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Define Path Traversal and distinguish it from a neighboring concept.
- Choose a realistic task where Path Traversal is appropriate.
- Identify a failure mode caused by misusing Path Traversal.
- Interpret a small design or result involving Path Traversal.
- Explain one tradeoff or limitation of Path Traversal.
Documentation and sources
- OWASP Developer Guide: Security Principles (devguide.owasp.org)
Connect the ideas
Explore next
Real World Example
Secure Document Retrieval System
A document management platform that allows users to download archived reports stored on a server filesystem.
The business problem
Attackers may manipulate file path parameters using sequences like ../ to escape the intended directory and access sensitive system configuration files or unauthorized data.
How this topic solves it
Implement path validation by resolving the absolute path of the requested file and verifying that it starts with the designated base directory before any read operation occurs.
- Define a strict base directory constant for all accessible files.
- Accept the user-provided filename as an untrusted input.
- Resolve the canonical path of the combined base directory and user input.
- Compare the resolved path against the base directory prefix.
- Reject the request if the path is outside the base directory or serve the file if valid.
The flow shows how user input is sanitized before accessing the filesystem.
Combines base path and input
Checks if path starts with base
Storage of documents
- User Input → Passes input → Path Resolver
- Path Resolver → Resolves canonical path → Validation Logic
- Validation Logic → Accesses file if valid → Filesystem
Implementation example
This code maps to the Secure Document Retrieval System by using path.resolve to normalize the input and then verifying the prefix to ensure the file resides within the intended directory.
const path = require('path');
const baseDir = '/var/www/docs';
// Resolve absolute path to prevent traversal
const safePath = path.resolve(baseDir, userInput);
// Ensure the resolved path starts with the base directory
if (safePath.startsWith(baseDir)) {
// Serve file
} else {
// Deny access
}Expected business outcome
The application prevents unauthorized file access while maintaining the ability to serve legitimate user requests.
Limitations and checks
Canonicalization can be bypassed if the underlying filesystem or language runtime does not correctly handle symbolic links or specific encoding schemes, requiring periodic security audits of the path resolution logic.