Path traversal
Input such as ../ escapes the intended directory when an application builds a file path from it (CWE-22). Resolve the full path and check that it stays inside the allowed root.
- Also called
- directory traversal · Zip Slip
- Fix it in your stack
- Path traversal fix cards (10 stacks) · CWE-22 page
- Defined in
- MITRE CWE-22
- Identifiers
- CWE-22: Path traversal
Covered in
Extract archives without escaping the destination
Prevent traversal, link tricks, overwrites and decompression exhaustion while preserving legitimate file extraction.
Prevent file inclusion: LFI, RFI, dynamic imports and template names
Stop request data from choosing which file, module or template your application loads: local and remote file inclusion in PHP, dynamic require() and import() in Node.js, importlib and template names in Python, Thymeleaf view names in Spring, render in Rails, and the allowlist fix that works in all of them.
Abuse case library: tests and controls by feature
Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.
Convert untrusted office documents and PDFs in an isolated parser
DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.
Practice: Path traversal lab: Keep archive entries inside their extraction directory · Path traversal lab: Serve an uploaded file without path traversal · File upload lab: Accept avatars without publishing pages · Local project: Keep extracted files inside their boundary