Description

This detector identifies path traversal vulnerabilities in Flask applications where user-controlled input can be used to write files to arbitrary locations on the filesystem. The vulnerability occurs when file paths are constructed using unsanitized user input, potentially allowing attackers to overwrite system files or write malicious files outside the intended directory.

Detection Strategy

• Reports when Flask library is imported in the Python code

• Reports when file write operations (like open(), file(), or similar file writing functions) are detected

• Reports when the file path or destination for these write operations can be influenced by user input through Flask request data (form data, URL parameters, headers, etc.)

• Reports when there is insufficient validation or sanitization of the user input that determines the file write destination

Vulnerable code example

from flask import Flask, request
from pathlib import Path

app = Flask(__name__)

@app.post("/upload")
def upload():
    filename = request.form["filename"]...

✅ Secure code example

from flask import Flask, request
from pathlib import Path
from werkzeug.utils import secure_filename

app = Flask(__name__)

@app.post("/upload")
def upload():...