Path traversal
Named by 87 kept items in this workspace.
50 items name it under classification.key entities and 37 under techniques.
Search every workspace for Path traversal. It matches the name as written, so it can find other things that share it.
The items that name it 87
Overwriting arbitrary files on the host filesystem when extracting embedded PDF attachments
Used to redirect a privileged Azure API Connections request to another tenant's connection and use its stored credentials.
Allows arbitrary file writes (CVE-2026-108140, CVE-2026-108141)
Illustrative attack example: GET /download?file=../../config/database.ini tries to read a private configuration file outside the permitted directory.
The query-id value in SendQueryResult is concatenated into /query/result/<query-id> without validation, so ../ sequences let an unauthenticated attacker pick any directory
Paths starting in the trusted Extensions directory use ..\ to resolve outside it, allowing reads of SSMS.isolation.ini and the user settings file without confirmation
via the filename parameter of the static_content route in changedetection.io, allowing file path manipulation
Low-privileged authenticated user writes files outside their own home directory in Laranode
Used '..' and encoded '%2e%2e' segments in DynamicInvoke and DynamicList paths so APIM operated on a victim's connection, giving cross-tenant access to Key Vault secrets and SQL databases
Path traversal + NULL-byte neutralization flaw allowing unauthenticated arbitrary file write via crafted HTTP/HTTPS requests to FortiMail
PageBreak validates it by writing a file in a world-readable location
cited as a CWE within A01:2025 Broken Access Control category that has a traceable shape detectable by static analysis
CVE-2022-27925, chained with authentication bypass to drop a JSP shell without credentials.
cited as one of the top categories in the 30+ CVE breakdown (43/20/13/10 split); 82% of a 2,614-server scan found vulnerable to path traversal
File-path parameters are not canonicalized, allowing an attacker to read, write, or delete arbitrary files.
Exploitation of CVE-2026-85706 via the repository commits API, enabling unauthenticated reading of arbitrary files due to improper path confinement and missing authentication enforcement.
Client-supplied file path passed unvalidated to a file-open call (Atlassian MCP CVE-2026-73498); also identified as path traversal via cursor manipulation in the 'Exposed by design' study.
Supplying a relative path starting with ../../../../../ to escape the default BouncedWavFiles directory and reach the user's home folder without knowing the username
The cohttp 6.3.0 vulnerability, exploited via percent-encoded path traversal sequences probed against the author's live webserver within minutes/ten minutes of the public PR being opened.
Directory traversal payloads, encoded path manipulation, null byte injection
classic bug shown up in real MCP servers
darwin-init's extract(to:) function appends archive entry pathnames directly to the output directory without sanitization, allowing '../' sequences in a tar archive to write files outside the intended extraction directory (e.g., '../../../../db/' to reach /var/db/).
one of the three oldest injection classes cited alongside SQL injection and command injection
Payload coverage
Path traversal vulnerability hunting
Used in CVE-2026-48282 to achieve arbitrary code execution in Adobe ColdFusion.
Systematic SAST class where models were weaker; repeatedly missed by models, including every path-traversal reference finding missed by Claude Opus 4.6 High across five repetitions in the js-project-nightowl fixture, which involved repeated attachment upload/download/delete flows.
Covered by Semgrep rules
Product uses external input to construct a pathname intended to identify a file/directory under a restricted parent directory, but does not properly neutralize special elements that cause the pathname to resolve outside the restricted directory
LangChain local file store accepting user-controlled keys/prefixes that could resolve outside a configured root directory, e.g. via yield_keys(prefix) not validated
Injection of traversal sequences into the ?url= parameter (standard ../, URL encoded %2f, double-encoded %252f, null byte ..%00, backslash ..%5c, unicode overlong ..%c0%af, non-recursive ....//) targeting /app/main.py, /proc/self/environ, /app/requirements.txt; all blocked
described as a frequent attack vector for malicious cyber actors
Improper limitation of a pathname to a restricted directory, used in CVE-2026-104286 to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Attackers supply absolute paths or ../ traversal sequences directly to document open and save operations to read arbitrary .docx files or create/overwrite .docx files outside the intended working directory, bypassing the check_file_writeable and ensure_docx_extension helpers which perform no base-di
Exploiting path traversal in Cisco Secure Email Gateway and Secure Email and Web Manager (CVE-2026-20353 group).
All techniques in this workspace.