Tested fixes for CWE-22 in Express, Flask, Spring Boot, ASP.NET Core, Next.js, FastAPI, Django, net/http, Rails and Laravel: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.
MITRE’s description of CWE-22: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Common consequences MITRE lists
- Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands
- Integrity: Modify Files or Directories
- Confidentiality: Read Files or Directories
- Availability: DoS: Crash, Exit, or Restart
A crafted path such as ../../etc/passwd reads or overwrites files outside the intended directory, exposing secrets or planting code the server later runs.
- Do not build filesystem paths from user input; map user choices to server-generated names or identifiers.
- When a path must be accepted, canonicalize it and confirm the result is still inside the base directory before opening it, or use directory-relative APIs that refuse to leave it.
- Reject absolute paths,
..components, symbolic links and device names in uploads and archive entries. - Run with filesystem permissions that limit what a traversal could reach.
Guides on this site
Extract archives without escaping the destination
Prevent traversal, link tricks, overwrites and decompression exhaustion while preserving legitimate file extraction.
Convert untrusted office documents and PDFs in an isolated parser
DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.
Abuse case library: tests and controls by feature
Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.
Prevent file inclusion: LFI, RFI, dynamic imports and template names
Stop request data from choosing which file, module or template your application loads: local and remote file inclusion in PHP, dynamic require() and import() in Node.js, importlib and template names in Python, Thymeleaf view names in Spring, render in Rails, and the allowlist fix that works in all of them.
Practice
- Path traversal lab: Keep archive entries inside their extraction directory · Browser lab
- Path traversal lab: Serve an uploaded file without path traversal · Browser lab
- File upload lab: Accept avatars without publishing pages · Browser lab
- Keep extracted files inside their boundary · Local project
- Convert untrusted documents in a locked-down container · Local project
References
- CWE-22 in the MITRE CWE list (version 4.20)
- 2025 CWE Top 25 Most Dangerous Software Weaknesses (MITRE CWE Program)
- OWASP File Upload Cheat Sheet
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.