Path traversal: ../ is still breaking apps

If a filename from the user ends up in a file path, someone will try ../../etc/passwd. Check the final path, not the input.

6 August 2026 · 1 min read

A download endpoint takes ?file=report.pdf and reads it from a folder. Someone sends ?file=../../config/.env instead. If the code just joins the folder and the input, it reads the config file. The same bug in an upload or extract function can write files anywhere, which often means running code.

This year’s exploited bugs in security appliances and file servers include plenty of path traversal. It’s old, and it keeps happening.

How to avoid it:

Don’t use user input as a path at all if you can. Store files under random IDs and look up the name in a database.
If you must, resolve the full path (realpath, Path.resolve) and check it still starts with the allowed folder.
Reject absolute paths, .., null bytes and backslashes before you even get there.
When extracting ZIP or TAR files, check every entry’s path the same way.