Lack of data validation - Path Traversal
Description
The software uses external input to construct a pathname that is intended to identify a file or directory but it does not properly neutralize or validate special elements within the pathname.
Impact
Make the software resolve the pathname to a location that is outside of the intended target, for instance: /etc/passwd.
Recommendation
- Prevent the attacker from constructing the pathname. - Validate/Neutralize the input for special elements like: .., ~, /.
Threat
Authenticated attacker from the Internet.
Expected Remediation Time
⏱️ 45 minutes.
Requirements
173 - Discard unsafe inputs320 - Avoid client-side control enforcement342 - Validate request parameters381 - Use of absolute pathsRules
Http Path Traversal In Query ParamsHttp Path Traversal In Url PathGo Zip Slip Path TraversalRuby Path Traversal Unsanitized InputPython Fastapi Path TraversalDart Unsafe Input Path Traversal RelativeJava Zip Slip VulnerabilitySwift File Manager Path TraversalJava Path Traversal Unvalidated PathparamTypescript Zip Slip Path TraversalKotlin Path Traversal Unsanitized InputC Sharp Unsafe Path TraversalPython Send File Path TraversalTypescript Path Traversal Vulnerability ExpressPython Starlette Path TraversalKotlin Path Traversal Unsanitized ParamPhp Arbitrary File ReadC Sharp Open Redirect Unvalidated UrlJavascript Zip Slip Path TraversalTypescript Path Traversal VulnerabilityPhp Unsafe File InclusionJavascript Path Traversal VulnerabilityJava Path Traversal From CookieScala Unsafe Input Path TraversalDart Unsafe Input Path TraversalJavascript Path Traversal Vulnerability ExpressPython Django Path Traversal