Fix path traversal in Node.js and Express

1. Find every fs call, res.sendFile and res.download whose path includes request data (req.query, req.params, req.body, headers or uploaded file names), including in helper modules.
2. Resolve the base directory with fs.promises.realpath, then resolve the request against it with realpath(path.resolve(base, name)); realpath also rejects with ENOENT for a missing file.
3. Serve the file only if the real path starts with base + path.sep, and answer the same 404 for refused and missing paths so the response does not reveal what exists outside the folder.
4. Accept only one non-empty string: Express returns an array for ?path=a&path=b, and Node's fs functions throw on a NUL byte.
5. Add regression tests with this card's payloads: ../, %2e%2e%2f, an absolute path, ..\, the files-secret sibling, a symlink created in a temporary directory, and ....//.
6. When users only pick from known files, map an ID to a server-side path instead of accepting a path at all.

The three implementations share one API and one test suite; only the code below changes. The tests load the one that IMPL names.

export async function readUserFile(baseDir, requestedPath) {
  return readFile(path.join(baseDir, requestedPath));
}

export async function readUserFile(baseDir, requestedPath) {
  // realpath() returns an absolute path with ../ collapsed and every symlink followed.
  // Resolve the base the same way: on macOS, for example, /var is a link to /private/var.
  const base = await realpath(baseDir);
  // path.resolve() lets an absolute requestedPath replace base; the check below catches it.
  // realpath() rejects with ENOENT for a missing file, which the route answers with 404.
  const target = await realpath(path.resolve(base, requestedPath));
  // Compare with a trailing separator: /srv/files-secret starts with "/srv/files"
  // but is not inside /srv/files.
  if (!target.startsWith(base + path.sep)) {
    return null;
  }
  return readFile(target);
}

export async function readUserFile(baseDir, requestedPath) {
  const cleaned = requestedPath.replace(/\.\.\//g, '');
  return readFile(path.join(baseDir, cleaned));
}

The exploit tests send the attack and check that it fails; functional tests next to them keep ordinary requests working, so a fix that rejects everything fails too.

describe(`exploit (IMPL=${implName})`, () => {
  // Each payload aims at a real file outside files/, so a leak would come back as a 200.
  test('../ cannot climb out of the base directory', async () => {
    assertNotServed(await get('../secret.txt'));
  });

  test('percent-encoded ../ is decoded by Express and still refused', async () => {
    assertNotServed(await getRaw('path=%2e%2e%2fsecret.txt'));
  });

  test('an absolute path cannot replace the base directory', async () => {
    assertNotServed(await get(path.join(tmp, 'secret.txt')));
  });

  test('backslashes cannot climb out (a separator on Windows)', async () => {
    assertNotServed(await get('..\\secret.txt'));
  });

  test('a sibling folder that shares the prefix is outside (files-secret vs files)', async () => {
    assertNotServed(await get('../files-secret/api-keys.txt'));
  });

  test('a symlink inside the base cannot lead outside it', async () => {
    await symlink(path.join(tmp, 'files-secret'), path.join(baseDir, 'shared'));
    assertNotServed(await get('shared/api-keys.txt'));
  });

  test('....// does not turn back into ../ (single-pass filter bypass)', async () => {
    assertNotServed(await get('....//secret.txt'));
  });
});

• path.join(base, name) is not a check: it collapses ../ and happily returns a path outside base.
• path.join('/srv/files', '/etc/passwd') stays under the base, but path.resolve('/srv/files', '/etc/passwd') returns /etc/passwd. The fix uses resolve() and lets the containment check refuse absolute names.
• Compare with base + path.sep: '/srv/files-secret/api-keys.txt'.startsWith('/srv/files') is true.
• replace(/\.\.\//g, '') makes one pass, so ....// turns back into ../. Filtering the string cannot tell where the path will land.
• res.sendFile(name, { root }) and express.static refuse a ../ segment, but both served a file through a symlink inside the root that points outside it (checked with Express 5.3.0, send 1.2.1 and serve-static 2.2.1). Express's documentation says root contains access; that holds for the path string, not for links.
• Express decodes values before your code sees them: a query value of %2e%2e%2f arrives as ../, and a route parameter in /files/:name receives ../../secret.txt from /files/..%2F..%2Fsecret.txt.
• Compare real paths on both sides. On macOS, os.tmpdir() lives under /var, a symlink to /private/var, so a realpath() result never starts with the configured string and every legitimate file would be refused.
• On Windows a backslash is also a separator: path.win32.resolve('C:\\srv\\files', '..\\secret.txt') is C:\srv\secret.txt. The resolve-then-check fix covers it; filters that look for '/' do not.
• realpath() followed by readFile() leaves a window in which someone who can write inside the base can swap in a symlink. Keep the served tree read-only for untrusted users; Node has no binding for Linux's openat2 RESOLVE_BENEATH, which enforces containment at open time.

1. Run the tests in all three modes: IMPL=fixed must pass; IMPL=vulnerable and IMPL=wrong must fail (node ../../run-all.mjs path-traversal/node-express does this for you).
2. Against your own endpoint, request ?path=..%2Fsecret.txt, an absolute path and a file reached through a symlink that points outside the base; each must answer 404 without the file's content.
3. Do not count on static analysis here: the Semgrep rules above report nothing for node:-prefixed imports, and with plain imports they also flag the fixed code. The regression tests are the control.

What each rule reported when it was run on this card's code, or what its source shows it covers where it was not run. A rule that exists for the weakness does not always catch it.

Download the project, install its dependencies once (this step needs the network), then run the tests against each implementation from the path-traversal/node-expressfolder.

npm ci

# Expected: every test passes
IMPL=fixed npm test --silent

# Expected: an exploit test fails
IMPL=vulnerable npm test --silent

# Expected: a test fails
IMPL=wrong npm test --silent

Each run writes a JUnit report to reports/junit.xml. From the top folder of the download, node run-all.mjs path-traversal/node-express runs all three modes and checks the expected results.

Download the project ZIP, 25 KB

Verified

Machine

macOS 27.0 (Darwin 27.0.0, arm64)

Toolchain

• node 26.11.1
• npm 11.20.0
• express 5.3.0

Matrix

fixed: 12 of 12 tests pass; vulnerable: 4 of 12 tests fail (4 exploit tests); wrong: 2 of 12 tests fail (2 exploit tests)

Test results

IMPL=fixed 12/12 pass; IMPL=vulnerable 4/12 fail, all exploit tests (../, %2e%2e%2f, the files-secret sibling, the symlink); IMPL=wrong 2/12 fail, both exploit tests (the symlink and ....//). The absolute-path test passes even for the vulnerable code because path.join keeps an absolute name under the base. The ..\ test passes in every mode on macOS and Linux, where a backslash is an ordinary file-name character; it guards a Windows deployment.

Dependency freshness

express 5.3.0 was published 2026-10-09, one day before verification. It is taken anyway because it is a security release (qs, proxy-addr and body-parser fixes); the previous 5.2.1 dates from 2025-12-01. npm audit reported 0 vulnerabilities in the 65 installed packages.

Scanners

Semgrep 1.180.0 from a throwaway venv (pip install semgrep==1.180.0), not a card dependency; CodeQL read from source, not executed.

Versions and results hold for the toolchain above. The card's tests are the check: run them with your own versions before relying on the fix.

References

1. OWASP: Path Traversal
2. OWASP WSTG: Testing Directory Traversal File Include
3. Node.js v26: path.resolve()
4. Node.js v26: path.join()
5. Node.js v26: fsPromises.realpath()
6. Express 5: res.sendFile() (root option and security note)
7. Express 5: express.static()
8. PortSwigger Web Security Academy: Path traversal (nested ....// and encoded sequences)
9. Linux man page: openat2(2) and RESOLVE_BENEATH

Attack patterns:

• CAPEC-126 at MITRE
• CAPEC-139 at MITRE
• CAPEC-597 at MITRE
• CAPEC-64 at MITRE
• CAPEC-79 at MITRE
• CAPEC-132 at MITRE