Cybersecurity glossary
What is Directory Traversal?
Learn what directory traversal (path traversal) is, how ../ sequences escape intended file directories, what attackers can read or write, and how canonicalization and allowlists prevent it.
Definition
Directory traversal, also called path traversal, is a vulnerability in which attackers manipulate file path parameters to escape a restricted directory and access files or directories outside the intended scope using sequences such as ../ or absolute paths.
Why directory traversal matters
Applications constantly touch files: templates, PDFs, images, exports, and downloads. When a parameter such as ?file=report.pdf is joined to a base directory without strict controls, attackers can request ../../etc/passwd style paths and escape the intended folder.
Directory traversal (path traversal) is old, simple, and still common—especially in download endpoints, zip extractors, backup utilities, and document preview features. Successful reads expose secrets. Successful writes can become remote code execution.
How directory traversal works
Locate a path parameter
Find inputs used to read, write, include, or delete files: filenames, template names, storage keys.
Inject traversal sequences
Try ../, ..\, absolute paths, and encoded variants to escape the base directory.
Observe application behavior
Differences in status codes, lengths, or content reveal whether files outside the root are reachable.
Target sensitive files
Request configuration, keys, source, or credential material accessible to the app user.
Escalate when writable
Overwrite executables, plant webshells, or poison include paths if write operations are exposed.
Automate across hosts
Repeat against related services, containers, and legacy download APIs.
Common vulnerable patterns
Download by filename
User-supplied names concatenated onto /var/data/exports without canonical checks.
Template or language packs
Locale codes or theme names mapped directly to filesystem paths.
Zip slip extraction
Archive entries containing ../ write files outside the extract directory.
Object storage key confusion
Application prefixes a key but still allows absolute-like or traversal segments depending on API semantics.
Traversal vs related file bugs
| Issue | Core failure |
|---|---|
| Directory traversal | Path escapes a restricted directory boundary |
| LFI | Local file is included/executed or rendered through an unsafe include sink |
| RFI | Remote resource is included through an unsafe include sink |
| Unrestricted upload | Dangerous file types or locations accepted on write |
Prevention checklist
- Prefer server-side identifiers mapped to stored paths instead of raw user filenames.
- If accepting names, allowlist characters and known filenames only.
- Resolve to a canonical absolute path and verify it starts with the intended root directory.
- Reject absolute paths, drive letters, and null-byte tricks where relevant to the stack.
- Handle archives carefully; validate every extracted entry against the target directory.
- Run the application with least filesystem privilege; sensitive host files should be unreadable.
- Log denied traversal attempts and monitor for repeated ../ patterns.
- Do not rely on blacklist filters for ../ alone; encodings and platform differences bypass them.
The practical takeaway
Directory traversal lets attackers escape a supposed file sandbox by manipulating paths. It is a boundary problem: the application must ensure the final resolved path remains inside an approved root.
Never trust user input as a filesystem path. Map IDs to files, allowlist, canonicalize, and enforce the root check on every read and write.
Related security terms
Local File Inclusion (LFI)
Often overlaps when traversal is used to include local files into execution or response output.
Remote File Inclusion (RFI)
A related inclusion flaw that pulls remote resources instead of climbing local directories.
Remote Code Execution (RCE)
Possible impact when traversed paths reach executable upload or include sinks.
Web Application Firewall (WAF)
Can detect some traversal payloads but should not replace safe path handling.
Frequently asked questions
What is directory traversal in simple terms?
Directory traversal happens when an application builds a file path from user input and an attacker adds ../ or similar tricks to leave the safe folder and open sensitive files elsewhere on the system.
What files do attackers usually target?
Common targets include password files, application configs, private keys, environment files, source code, and logs that reveal secrets or architecture details.
Is directory traversal only a read problem?
No. If the application writes, uploads, or deletes using the attacker-controlled path, traversal can also enable file overwrite, webshell planting, or destructive operations.
Does URL-encoding bypass traversal filters?
Sometimes. Attackers use encoding, double encoding, Unicode tricks, backslashes on Windows, or nested paths to evade naive ../ blacklists.
How do you prevent directory traversal?
Avoid building filesystem paths from user input. When necessary, validate against an allowlist of filenames, resolve canonical paths, and verify the final path stays inside an intended root directory.
How is traversal different from LFI?
Traversal is about escaping path boundaries. LFI specifically includes a local file into an application execution or rendering context. Many LFI exploits use traversal sequences as the delivery method.
Can chroot or containers fully stop traversal?
Isolation reduces blast radius but is not a substitute for correct path handling. Misconfigured mounts and shared volumes can still expose sensitive files.
References
Explore authoritative guidance and frameworks related to directory traversal.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.