Directory Traversal

Directory traversal defects let attackers reach files outside the intended scope by manipulating file paths. Out there sit configuration files, credentials, keys, and source code (see UV-06).

Documented since the 1990s. Confinement and least privilege have been the durable approaches for most of that time. Input filtering, the popular answer, keeps losing to encodings, symlinks, and normalization order.

It still appears in web applications, file servers, and content management systems, despite being known and solvable.

Discussion prompts

• How does your application validate file path inputs — and is that validation applied consistently?
• Have you audited your application for directory traversal risk? What did you find?
• What default framework or library protections could eliminate directory traversal from your codebase?