Directory Traversal (Path Traversal)
highWhat is Path Traversal?
Directory traversal attacks exploit insufficient input validation to access files and directories outside the intended directory, using sequences like ../ to navigate the file system.
How it works
An attacker manipulates file path parameters (e.g., /download?file=../../../etc/passwd) to escape the application's web root and access sensitive system files.
Impact
Reading sensitive files (configuration files, credentials, source code), and in some cases writing arbitrary files leading to remote code execution.
ShieldReport tests file-handling endpoints with traversal sequences including URL-encoded, double-encoded, and null-byte injection variants.
How to fix it
Use a whitelist of allowed files. Resolve the canonical path and verify it's within the expected directory. Never use user input directly in file system operations.
Tags
Is your site vulnerable to Path Traversal?
Run a free scan to find out in under 2 minutes.
Scan Now