Directory Traversal
By Malcolm McDonald Founder, Editor-in-ChiefAuthor of Grokking Web Application Security
Ensure file paths are safely interpreted, or hackers can access sensitive files on your server.
- Prevalence
- Common
- Exploitability
- Moderate
- Impact
- Devastating
What is directory traversal?
Directory traversal, also called path traversal, is a file access attack in which an attacker manipulates a file path in a request, typically with ../ sequences, to reach files outside the intended directory. It occurs when user input is used to build file paths without validation, exposing configuration files, source code and credentials stored on the server.
What you'll learn
- How ../ sequences in a file path escape the intended directory
- Why passing raw file names from a request to the file system is dangerous
- How indirection, filename sanitization and restricted permissions protect your files
Where this lesson counts
OWASP Top 10
Users can reach data or actions their permissions should block, such as other users' records or admin-only functions. For 2025, this category also covers server-side request forgery (SSRF).
Learn more about A01PCI DSS v4.0.1
Requirement 6.2.4: engineering techniques must prevent injection, data-structure, cryptographic, business-logic and access-control attacks in bespoke software.
Learn more about 6.2.4Requirement 7.2.1: access to system components and data must follow a defined model based on business need and least privilege.
Learn more about 7.2.1This lesson includes
Directory Traversal lab
A restaurant menu site downloads whatever file is named in its menu parameter. Watch Trix climb out of the menus folder with ../ and reach system files, then edit the URL yourself to download the server's private SSL key.
How to prevent Directory Traversal
The prevention guide covers five approaches, including:
- Use a Content Management System
- Use Indirection
- Segregate Your Documents
Directory Traversal quiz
Two questions. Passing marks the lesson complete.
Sources
- Path Traversal PortSwigger
- Path Traversal OWASP
- What is a Directory Traversal Attack? Acunetix
Related lessons
Browse all 45 lessons
File Upload Vulnerabilities
File uploads are an easy way for an attacker to inject malicious code into your application.
Broken Access Control
All resources on your site need to have access control implemented, even if they aren't intended to be discoverable by a user.
Command Execution
If your application calls out to the OS, you need to be sure command strings are securely constructed.
Information Leakage
Revealing system information helps an attacker learn about your tech stack.