Path traversal
directory traversal · dot-dot-slash · file path traversal · CWE-22 · traversée de répertoires
A flaw that lets an attacker break out of the folder an application intended by manipulating a file name, in order to read or write sensitive files elsewhere on the server.
In practice
It appears when an application receives a file name or path (a download, an image, a template, an archive to unpack) and uses it unchecked. By climbing up the directory tree, an attacker can read configuration files containing passwords or keys, or even drop an executable file. The flaw is well understood and avoidable, yet in May 2024 CISA’s catalogue of actively exploited vulnerabilities listed 55 of this type.
In May 2024, CISA and the FBI devoted a “Secure by Design” alert to this flaw, following campaigns that exploited, among others, CVE-2024-1708 in the ConnectWise ScreenConnect remote access software and hit critical sectors, including healthcare.
How to protect yourself
- Never build a path from raw input: use generated identifiers and a lookup table.
- Normalise the path, then check that it stays inside the permitted folder.
- Restrict the characters allowed in file names (letters and digits).
- Run the application under an account that can only reach its own files.
