Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

Path Traversal

Path traversal lets an attacker climb out of an intended directory with dot-dot-slash sequences and read arbitrary files on the server. Here is how it works, the encodings that defeat naive filters, and the canonicalization fix that stops it.

3 articles 14 min total Overview to advanced techniques

Start with the overview

Path Traversal3 min read

Path Traversal: How ../ Reads Files You Never Meant to Share

Path traversal lets an attacker climb out of an intended directory with dot-dot-slash sequences and read arbitrary files on the server. Here is how it works, the encodings that defeat naive filters, and the canonicalization fix that stops it.

Read the overview

Path Traversal techniques

2 focused deep-dives
  1. 02 Encoding BypassBypassing Path-Traversal Filters: Encoding, Double-Encoding and Null Bytes 5 min
  2. 03 LFI / RFILFI vs RFI: From File Disclosure to Remote Code Execution 6 min