Browse / Path Traversal

Path Traversal

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Path Traversal264
• Externally Controlled Reference to a Resource in Another Sphere13
• Path Traversal: '.../...//'6
• External Control of File Name or Path5
• Relative Path Traversal3
• Uncontrolled Search Path Element1
• Improper Link Resolution Before File Access ('Link Following')1
• Untrusted Search Path1
• PHP Local File Inclusion1
• Path Traversal: 'dir\..\..\filename'1

Often found together with

• Code Execution66
• Information Disclosure51

Most upvoted Path Traversal reports

AllValidInformativeN/ADuplicate

1. Arbitrary File Read via file:// Protocol in cURLN/APath Traversal · critical · curl
   31 votes
2. Directory Traversal Vulnerability in cURL via Content-Disposition Header ProcessingN/APath Traversal · medium · curl
   25 votes
3. Path Traversal in curl file:// Protocol Handler Allows Unauthorized File AccessN/APath Traversal · high · curl
   18 votes
4. Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path NormalizationN/APath Traversal · high · curl
   18 votes
5. libcurl FTP path normalization flaw allows decoded %2e%2e → CWD .. and directory escape (Path Traversal, CWE-22)N/APath Traversal · high · curl
   16 votes
6. Path Traversal in file:// protocol allows Arbitrary File ReadN/APath Traversal · high · curl
   15 votes
7. curl External-Controlled Filename in `--url @file` Leads to Arbitrary File OverwriteN/AExternal Control of File Name or Path · low · curl
   13 votes
8. Multiple Path Transversal VulnerabilitesN/APath Traversal · medium · Tor
   11 votes
9. Path Traversal in SFTP QUOTE command leads to Arbitrary File Write and potential RCEN/ARelative Path Traversal · critical · curl
   10 votes
10. arbitrary file read via `file://` path traversal with `--path-as-is`N/APath Traversal · medium · curl
    10 votes
11. Arbitrary Configuration File Inclusion: via External Control of File Name or PathN/AExternal Control of File Name or Path · critical · curl
    9 votes
12. Vulnerability Report: Local File Disclosure via file:// Protocol in cURLN/APath Traversal · medium · curl
    9 votes
13. Malicious server forces .curlrc creation via curl -OJ leading to local file exfiltrationN/APath Traversal · curl
    8 votes
14. Arbitrary File Read via Unsanitized curl Usage Results in Sensitive File ExposureN/AExternal Control of File Name or Path · curl
    8 votes
15. Path Traversal Vulnerability in curl via Unsanitized IPFS_PATH Environment VariableN/APath Traversal · high · curl
    8 votes
16. inconsistently Rejection Logic in file:// URLs with AuthorityN/APath Traversal · low · curl
    7 votes
17. [High] Arbitrary File Write via Path Traversal in cURL CLI (`-o`, `--output`) (CWE-22: Improper Limitation of a Pathname to a Restricted Directory)N/APath Traversal · high · curl
    7 votes
18. Path Transversal inside saveContracts.jsN/ARelative Path Traversal · Sifchain
    7 votes
19. fix(security):Path Traversal BugN/APath Traversal · high · Linux Foundation Decentralized Trust
    3 votes