Web server folder traversal—usually called path traversal or directory traversal—is a weakness that lets untrusted input steer a file path outside the directory an application intended to allow. A string such as ../ is a common way to attempt that escape, but its appearance in a request does not by itself mean the server is vulnerable or compromised.
What directory boundary does traversal cross?
A web application may be designed to serve or process files only from a particular directory, such as its document root or a folder reserved for downloads. Path traversal occurs when unsafe handling of a user-influenced path allows the application to reach a file or directory beyond that intended boundary. OWASP also describes the technique as “dot-dot-slash,” “directory climbing,” or “backtracking.” OWASP’s Path Traversal guidance explains the underlying issue as manipulating variables that reference files.
As an Amazon Associate I earn from qualifying purchases.
For example, an application might accept a requested filename and append it to a directory intended for images. If the application does not safely constrain the resulting path, a value containing a parent-directory reference such as ../ may cause the file operation to look above the image directory instead. The vulnerability is the failure to enforce the directory boundary—not the mere presence of those characters.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How can user input affect a server file path?
Applications may use values from request parameters, forms, cookies, uploaded filenames, or other user-controlled sources to select local resources such as images, templates, or documents. If that data reaches a filesystem operation without reliable validation and containment, an attacker may influence which path the application resolves. OWASP’s testing guidance on directory traversal and file inclusion recommends identifying the input points that can affect file operations.
#1 Best Overall
Not every application builds paths in the same way. An application may reject a value, map it to a fixed resource, normalize it, or pass it through one or more decoding steps. The operating system and the file operation also matter. OWASP notes that Windows recognizes both slash and backslash as separators, while Unix uses slash; encoded separators and repeated decoding can also affect what the application validates compared with what the filesystem receives. MITRE’s CWE-24 and CWE-36 describe risks involving relative and absolute paths and incomplete path handling.
What can happen if a path escapes?
The result depends on the vulnerable operation and the permissions of the application’s server process. A traversal weakness may expose files outside the intended directory; if the application performs a write, the consequences can instead include modifying files the process is permitted to change. A path escape does not automatically mean that an attacker can read every server file, alter files, or execute code.
OWASP notes that file inclusion can, in some situations, lead to arbitrary code or system-command execution. That is a possible escalation under particular conditions, not the inevitable impact of every path traversal flaw. The application’s behavior, the available file operations, and the process’s access rights determine what is reachable.
How can developers prevent path traversal?
OWASP’s concise recommendation is: “Prefer working without user input when using file system calls.” Where users need to choose a resource, a safer design is to accept a constrained identifier and map it to a server-controlled filename, rather than accepting a filesystem path from the user.
- Keep trusted path components under application control and validate user choices against known-good values.
- Normalize or canonicalize the candidate path, then check that the final resolved path remains inside the allowed directory before using it.
- Do not rely on deleting suspicious substrings such as
../. Alternate separators or transformations can bypass incomplete filters or create dangerous input; MITRE discusses these filtering and canonicalization pitfalls in CWE-24 and CWE-36. - Decode input once into the representation the application will actually use, validate that representation, and avoid double-decoding.
- Give the server process only the filesystem permissions it needs, and keep sensitive configuration outside the web root as an additional safeguard.
These controls work together: a known-good mapping reduces dependence on user-supplied paths, a containment check protects the directory boundary, and limited process permissions reduce the potential damage if another control fails. The relevant controls and their details are set out in OWASP’s Path Traversal guidance and MITRE’s CWE entries.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should path traversal be assessed?
For an authorized security assessment, start by listing user-controlled inputs that can influence file operations. Then evaluate whether the application keeps the resolved path within its intended directory and whether its validation handles relevant separators, encodings, and normalization behavior. Interpret results in the context of the application, platform, and server-process permissions; a suspicious input alone does not establish that a boundary was crossed. OWASP’s testing guide describes this input-focused approach. Testing should be limited to systems for which you have authorization.
Quick Recap
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
