../ or encoded variants, attackers can read sensitive system files, application source code, configuration files containing credentials, or write to arbitrary locations.Why It Matters for AI-Coded Apps
AI-generated file handling code rarely validates file paths properly. When a vibe coder prompts ‘add a file download feature,’ the AI generates the simplest working solution that directly concatenates user input with a base directory, creating an exploitable path traversal vulnerability.
Real-World Example
An API endpoint serves user uploads: app.get('/files/:name', (req, res) => res.sendFile('/uploads/' + req.params.name)). An attacker requests /files/../../etc/passwd and reads the system password file. The fix: use path.resolve() and verify the resolved path starts with the intended directory.
How to Detect and Prevent It
Always resolve file paths to their canonical form and verify they fall within the expected directory. Use allowlists of permitted file names when possible. Never concatenate user input directly into file paths. Use framework-provided safe file serving methods. Strip or reject inputs containing .., ~, or null bytes.
Frequently Asked Questions
What files do attackers target with path traversal?
Does using a CDN prevent path traversal?
How do I test for path traversal?
../ sequences in any parameter that references files: URL paths, query parameters, form fields, and HTTP headers. Test encoded variants like %2e%2e%2f, ..%5c, and double-encoding. Automated tools like OWASP ZAP and Burp Suite include path traversal scanners.