{
  "slug": "path-traversal",
  "url": "https://library.infinity8labs.com/path-traversal/",
  "title": "Path traversal",
  "short": "Path traversal",
  "aliases": [
    "Directory traversal",
    "Dot-dot-slash attack",
    "File path traversal"
  ],
  "summary": "Path traversal lets untrusted input escape an intended directory and access other files or locations. It can expose secrets, overwrite application data, or turn file-handling features into server compromise.",
  "cwe": [
    "CWE-22"
  ],
  "owasp": "A01:2021 Broken Access Control",
  "typical_severity": {
    "min": "medium",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory",
      "url": "https://cwe.mitre.org/data/definitions/22.html"
    },
    {
      "title": "OWASP Path Traversal",
      "url": "https://owasp.org/www-community/attacks/Path_Traversal"
    },
    {
      "title": "OWASP Top 10 A01:2021 Broken Access Control",
      "url": "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
    },
    {
      "title": "PortSwigger Web Security Academy: Directory traversal",
      "url": "https://portswigger.net/web-security/file-path-traversal"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/path-traversal/#overview",
    "https://library.infinity8labs.com/path-traversal/#impact",
    "https://library.infinity8labs.com/path-traversal/#examples",
    "https://library.infinity8labs.com/path-traversal/#remediation",
    "https://library.infinity8labs.com/path-traversal/#testing",
    "https://library.infinity8labs.com/path-traversal/#references"
  ]
}