# Directory Traversal (Path Traversal)

/etc/passwd              # User accounts
/etc/shadow              # Password hashes (if privileged)
/etc/hosts               # Network configuration
/var/log/apache2/access.log  # Web server logs
/var/www/.env            # Environment variables (database passwords!)
/home/user/.ssh/id_rsa   # SSH private keys
~/.bash_history          # Command history
/proc/self/environ       # Process environment variables

C:\Windows\System32\config\SAM    # User password hashes
C:\Windows\win.ini                # Windows configuration
C:\inetpub\wwwroot\web.config     # IIS configuration
C:\Users\Administrator\.ssh\id_rsa
C:\xampp\htdocs\.env

../config.php            # Database credentials
../database.yml          # Database configuration
../.env                  # Environment secrets
../wp-config.php         # WordPress database credentials
../settings.py           # Django settings (SECRET_KEY, DB passwords)
../../package.json       # Project dependencies and info

import os
from flask import Flask, request, send_file, abort

ALLOWED_FILES = {
    'report': 'monthly_report.pdf',
    'invoice': 'invoice_2024.pdf',
    'manual': 'user_manual.pdf'
}

@app.route('/download')
def download():
    file_id = request.args.get('file')

    # Whitelist validation
    if file_id not in ALLOWED_FILES:
        abort(400, "Invalid file")

    filename = ALLOWED_FILES[file_id]
    return send_file(f'/var/www/uploads/{filename}')

const express = require('express');
const path = require('path');

const FILES = {
    '1': 'report.pdf',
    '2': 'invoice.pdf',
    '3': 'manual.pdf'
};

app.get('/download/:id', (req, res) => {
    const fileId = req.params.id;

    if (!FILES[fileId]) {
        return res.status(400).send('Invalid file ID');
    }

    const filename = FILES[fileId];
    const filePath = path.join(__dirname, 'uploads', filename);
    res.sendFile(filePath);
});

import os
from pathlib import Path
from flask import Flask, request, send_file, abort

UPLOAD_DIR = '/var/www/uploads/'

@app.route('/download')
def download():
    filename = request.args.get('file')

    # Construct full path
    requested_path = os.path.join(UPLOAD_DIR, filename)

    # Resolve to absolute path (removes ../ sequences)
    real_path = os.path.realpath(requested_path)

    # Verify it's still within allowed directory
    if not real_path.startswith(os.path.realpath(UPLOAD_DIR)):
        abort(403, "Access denied")

    # Verify file exists
    if not os.path.isfile(real_path):
        abort(404, "File not found")

    return send_file(real_path)

const path = require('path');
const fs = require('fs');

const UPLOAD_DIR = path.resolve(__dirname, 'uploads');

app.get('/download', (req, res) => {
    const filename = req.query.file;

    // Construct and resolve path
    const requestedPath = path.join(UPLOAD_DIR, filename);
    const realPath = path.resolve(requestedPath);

    // Verify within allowed directory
    if (!realPath.startsWith(UPLOAD_DIR)) {
        return res.status(403).send('Access denied');
    }

    // Verify file exists
    if (!fs.existsSync(realPath) || !fs.statSync(realPath).isFile()) {
        return res.status(404).send('File not found');
    }

    res.sendFile(realPath);
});

import re
from flask import Flask, request, send_file, abort

UPLOAD_DIR = '/var/www/uploads/'

def sanitize_filename(filename):
    # Remove path separators and traversal sequences
    filename = filename.replace('/', '').replace('\\', '')
    filename = filename.replace('..', '')

    # Allow only alphanumeric, dash, underscore, dot
    filename = re.sub(r'[^a-zA-Z0-9._-]', '', filename)

    # Prevent hidden files
    if filename.startswith('.'):
        raise ValueError("Invalid filename")

    return filename

@app.route('/download')
def download():
    filename = request.args.get('file')

    try:
        safe_filename = sanitize_filename(filename)
    except ValueError:
        abort(400, "Invalid filename")

    filepath = os.path.join(UPLOAD_DIR, safe_filename)

    if not os.path.isfile(filepath):
        abort(404)

    return send_file(filepath)

<?php
function sanitize_filename($filename) {
    // Remove path separators
    $filename = str_replace(['/', '\\', '..'], '', $filename);

    // Allow only safe characters
    $filename = preg_replace('/[^a-zA-Z0-9._-]/', '', $filename);

    // Prevent empty or hidden files
    if (empty($filename) || $filename[0] === '.') {
        throw new Exception("Invalid filename");
    }

    return $filename;
}

$upload_dir = '/var/www/uploads/';
$filename = $_GET['file'];

try {
    $safe_filename = sanitize_filename($filename);
} catch (Exception $e) {
    http_response_code(400);
    exit('Invalid filename');
}

$filepath = $upload_dir . $safe_filename;

if (!is_file($filepath)) {
    http_response_code(404);
    exit('File not found');
}

header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . $safe_filename . '"');
readfile($filepath);
?>

from django.http import FileResponse
from django.conf import settings
import os

def download_file(request):
    filename = request.GET.get('file')

    # Django's safe_join prevents traversal
    from django.utils._os import safe_join
    filepath = safe_join(settings.MEDIA_ROOT, filename)

    # safe_join returns None if traversal detected
    if filepath is None:
        return HttpResponseBadRequest('Invalid file path')

    return FileResponse(open(filepath, 'rb'))

class DownloadsController < ApplicationController
  def show
    filename = params[:file]

    # Rails.root.join prevents traversal
    filepath = Rails.root.join('uploads', filename)

    # Verify within uploads directory
    unless filepath.to_s.start_with?(Rails.root.join('uploads').to_s)
      return head :forbidden
    end

    send_file filepath
  end
end

import zipfile
import os

def safe_extract(zip_path, extract_to):
    with zipfile.ZipFile(zip_path, 'r') as zf:
        for member in zf.namelist():
            # Construct target path
            target_path = os.path.join(extract_to, member)

            # Normalize and check
            target_path = os.path.realpath(target_path)
            extract_dir = os.path.realpath(extract_to)

            # Verify extraction stays within target directory
            if not target_path.startswith(extract_dir):
                raise Exception(f"Attempted path traversal: {member}")

            # Safe to extract
            zf.extract(member, extract_to)

const AdmZip = require('adm-zip');
const path = require('path');

function safeExtract(zipPath, extractTo) {
    const zip = new AdmZip(zipPath);
    const extractDir = path.resolve(extractTo);

    zip.getEntries().forEach(entry => {
        const targetPath = path.resolve(extractTo, entry.entryName);

        // Verify within extraction directory
        if (!targetPath.startsWith(extractDir)) {
            throw new Error(`Path traversal attempt: ${entry.entryName}`);
        }

        zip.extractEntryTo(entry, extractTo, false, true);
    });
}

../../../etc/passwd
../../../../etc/passwd
../../../../../etc/shadow
../../../../../../var/log/apache2/access.log
../../../home/user/.ssh/id_rsa
/etc/passwd
/etc/shadow

..\..\..\Windows\win.ini
..\..\..\..\Windows\System32\config\SAM
C:\Windows\win.ini
C:\boot.ini

../config.php
../../.env
../../../wp-config.php
../../database.yml
../settings.py

..%2f..%2f..%2fetc%2fpasswd
..%252f..%252f..%252fetc%252fpasswd
..%c0%af..%c0%af..%c0%afetc%c0%afpasswd

....//....//etc/passwd
..\/..\/etc/passwd