Bridge WAF
Path traversal: reading files the application never meant to serve
Path traversal, also called directory traversal, is an attack in which input that names a file includes sequences that step out of the intended folder, so the application reads or writes a file somewhere else on the server. File inclusion is its more dangerous relative: the application does not just read the file but loads it as code, from the local disk or from a remote address.
Quick facts
- Also called
- Directory traversal, dot-dot-slash attack
- Weakness
- CWE-22: improper limitation of a pathname to a restricted directory
- OWASP category
- A01:2025 Broken Access Control; file inclusion (CWE-98) maps to A05 Injection
- Main fix
- Never build file paths from input; map identifiers to files the application chooses
- Does a WAF stop it?
- Mostly. Traversal sequences in parameters are recognisable, including common encodings
How a path traversal attack works
An application serves a file named in the request: a download, an image, a template, a language file. It joins a base folder with the name from the request and opens the result.
If the name contains parent-folder sequences, the joined path climbs out of the base folder. Enough of them reach the root of the file system, from where any readable file can be named: configuration with database passwords, keys, source code. Encoding the sequences in different ways is how attackers get past naive checks.
Local and remote file inclusion
Some applications load a file named in the request as code, for example a page template chosen by a parameter. With traversal, that becomes local file inclusion: the attacker makes the application run a file already on the server, such as a log file they managed to write into.
Remote file inclusion goes further. If the application accepts a full address and its runtime allows loading code over the network, the attacker names a file on their own server, and the application runs it. That is remote code execution, described on command injection.
Where path traversal hides
The obvious place is a download link that names a file. Less obvious ones include image resizers that take a path, language or theme selectors that load a file by name, report generators that read templates, and archive extraction, where file names inside an uploaded archive contain parent-folder sequences and are written outside the target folder.
Any feature that turns a value from outside into a file path deserves the same review. Values from cookies, headers and stored data count as outside too.
What a WAF catches, and what it misses
Parent-folder sequences, absolute paths and well-known sensitive file names in a parameter are some of the most recognisable patterns there are, and rule sets match them in many encodings.
A filter misses traversal through values it does not inspect, such as names inside uploaded archives, and paths built from several parameters joined later. It also leaves the file handling unchanged, so a new encoding may still work.
How to prevent path traversal
- Do not use input as a path. Map an identifier from the request to a file name the application keeps in a list or database.
- If you must, validate strictly. Allow only expected characters and refuse anything else, as the OWASP Input Validation Cheat Sheet describes.
- Resolve, then check. Turn the path into its canonical form and confirm it is still inside the base folder before opening it.
- Never load code by name from input. Choose templates and modules from a fixed list.
- Run with least privilege. A process that cannot read secrets cannot leak them through traversal.
Questions
What is path traversal?
Path traversal, or directory traversal, is an attack in which input naming a file includes parent-folder sequences so the application reads or writes a file outside the folder it intended.
What is the difference between path traversal and file inclusion?
Path traversal reads or writes files outside the intended folder. File inclusion loads a file as code, from the server (local) or from another address (remote), which can lead to code execution.
How do you prevent directory traversal?
Do not build paths from input; map identifiers to files the application chooses, validate strictly when input must be used, and check the canonical path stays inside the base folder.