Browse / Path Traversal

Path Traversal

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Path Traversal264
• Externally Controlled Reference to a Resource in Another Sphere13
• Path Traversal: '.../...//'6
• External Control of File Name or Path5
• Relative Path Traversal3
• Uncontrolled Search Path Element1
• Improper Link Resolution Before File Access ('Link Following')1
• Untrusted Search Path1
• PHP Local File Inclusion1
• Path Traversal: 'dir\..\..\filename'1

Often found together with

• Code Execution66
• Information Disclosure51

Most upvoted Path Traversal reports

AllValidInformativeN/ADuplicate

1. [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped FilenamesInformativePath Traversal · high · curl
   54 votes
2. Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 FixInformativePath Traversal · high · Node.js
   39 votes
3. Path traversal in AcitveStorage, and lead RCEInformativePath Traversal · high · Ruby on Rails
   37 votes
4. Active Storage Vips Transformer Missing validate_transformation — CVE-2025-24293 Incomplete FixInformativePath Traversal · high · Ruby on Rails
   30 votes
5. 22: FTP wildcard matching decodes server-provided filenames, enabling directory traversalInformativePath Traversal · curl
   17 votes
6. Relative Path Traversal vulnerability in fabric-private-chaincodeInformativePath Traversal · Linux Foundation Decentralized Trust
   6 votes
7. `indexFile` option passed as an argument to node-server can lead to arbitrary file readInformativePath Traversal · low · Node.js third-party modules
   3 votes