What is Absolute Path Traversal (CWE-36)?

TL;DR: Absolute Path Traversal (CWE-36) occurs when an application fails to properly neutralize absolute path sequences, allowing attackers to create or overwrite critical files, read unexpected files, or disrupt system availability.

What is Absolute Path Traversal?

Absolute Path Traversal (CWE-36) is a type of broken access control vulnerability that occurs when an application uses external input to construct a pathname, but fails to properly neutralize absolute path sequences. As defined by the MITRE Corporation under CWE-36, and classified by the OWASP Foundation under A01:2025 - Broken Access Control, this vulnerability can have severe consequences for confidentiality, integrity, and availability.

Quick Summary

Absolute Path Traversal (CWE-36) is a critical vulnerability that occurs when an application fails to properly neutralize absolute path sequences. This can lead to the creation or overwriting of critical files, reading unexpected files and exposing sensitive data, or disrupting system availability by overwriting, deleting, or corrupting important files. Input validation and canonicalization are key mitigations for preventing this vulnerability.

Jump to: Quick Summary · Absolute Path Traversal Overview · How Absolute Path Traversal Works · Business Impact of Absolute Path Traversal · Absolute Path Traversal Attack Scenario · How to Detect Absolute Path Traversal · How to Fix Absolute Path Traversal · How to Ask AI to Check Your Code for Absolute Path Traversal · Absolute Path Traversal Best Practices Checklist · Absolute Path Traversal FAQ · Vulnerabilities Related to Absolute Path Traversal · References · Scan Your Own Site

Absolute Path Traversal Overview

What

Absolute Path Traversal (CWE-36) is a type of broken access control vulnerability that occurs when an application uses external input to construct a pathname, but fails to properly neutralize absolute path sequences.

Why it matters

This vulnerability can lead to the creation or overwriting of critical files, reading unexpected files and exposing sensitive data, or disrupting system availability by overwriting, deleting, or corrupting important files.

Where it occurs

Absolute Path Traversal (CWE-36) typically occurs in web applications that use external input to construct pathnames for file operations.

Who is affected

Developers who create web applications that use external input to construct pathnames are at risk of introducing this vulnerability.

Who is NOT affected

Applications that never construct paths/queries/commands from external input, such as those using hardcoded pathnames or stored procedures, are not typically affected by Absolute Path Traversal (CWE-36).

How Absolute Path Traversal Works

Root Cause

The root cause of Absolute Path Traversal (CWE-36) is the failure to properly neutralize absolute path sequences in external input used for pathname construction.

Attack Flow

1. An attacker provides malicious input containing absolute path sequences to the application.
2. The application uses this input to construct a pathname that resolves outside of the restricted directory.
3. The attacker gains access to sensitive files or disrupts system availability.

Prerequisites to Exploit

• External input is used for pathname construction
• Absolute path sequences are not properly neutralized in external input
• Sensitive files are stored in a restricted directory

Vulnerable Code

import os

path = request.form['path']
os.chdir(path)

This code snippet demonstrates a vulnerable implementation of pathname construction using external input.

Secure Code

import os

base_dir = '/restricted/directory'
input_path = request.form['path']

if not os.path.abspath(input_path).startswith(base_dir):
    raise ValueError('Invalid path')

os.chdir(input_path)

This code snippet demonstrates a secure implementation of pathname construction using input validation and canonicalization.

Business Impact of Absolute Path Traversal

The business impact of Absolute Path Traversal (CWE-36) can be significant, including:

• Confidentiality: sensitive data may be exposed or accessed by unauthorized parties
• Integrity: critical files may be created or overwritten, leading to data corruption or tampering
• Availability: system availability may be disrupted due to overwriting, deleting, or corrupting important files

Absolute Path Traversal Attack Scenario

Here is a step-by-step walkthrough of an attack scenario:

1. An attacker provides malicious input containing absolute path sequences to the application.
2. The application uses this input to construct a pathname that resolves outside of the restricted directory.
3. The attacker gains access to sensitive files or disrupts system availability.

How to Detect Absolute Path Traversal

Manual Testing

• Review code for pathname construction using external input
• Test application with malicious input containing absolute path sequences
• Verify that sensitive files are not accessible or modified

Automated Scanners (SAST/DAST)

• Use static analysis tools to identify potential vulnerabilities in pathname construction
• Use dynamic testing tools to simulate attacker behavior and identify potential weaknesses

PenScan Detection

PenScan’s scanner engines can detect Absolute Path Traversal (CWE-36) by analyzing code for pathname construction using external input and identifying potential vulnerabilities.

False Positive Guidance

When reviewing findings, consider the following:

• Context: ensure that the pattern is not safe due to surrounding code or configuration
• Input: verify that the malicious input was actually provided by an attacker

How to Fix Absolute Path Traversal

To fix Absolute Path Traversal (CWE-36), developers can use a combination of input validation, canonicalization, and secure coding practices.

Framework-Specific Fixes for Absolute Path Traversal

Here are some framework-specific fixes:

• Java: use Path objects and File objects to construct pathnames
• Node.js: use path.join() and fs.realpathSync() to construct pathnames
• Python/Django: use os.path.abspath() and os.path.join() to construct pathnames

How to Ask AI to Check Your Code for Absolute Path Traversal

To ask an AI coding assistant to review your code for Absolute Path Traversal (CWE-36), you can copy-paste the following prompt:

“Review the following [language] code block for potential CWE-36 Absolute Path Traversal vulnerabilities and rewrite it using input validation and canonicalization: [paste code here]”

Absolute Path Traversal Best Practices Checklist

Here is a checklist of best practices for preventing Absolute Path Traversal (CWE-36):

✅ Ensure that all input is properly validated and sanitized ✅ Use allowlists instead of denylists ✅ Implement robust input validation mechanisms ✅ Use canonicalization to normalize pathnames ✅ Review code for pathname construction using external input

Absolute Path Traversal FAQ

How is Absolute Path Traversal defined?

Absolute Path Traversal (CWE-36) is a type of broken access control vulnerability that occurs when an application uses external input to construct a pathname, but fails to properly neutralize absolute path sequences.

What are the common consequences of Absolute Path Traversal?

The attacker may be able to create or overwrite critical files, read unexpected files and expose sensitive data, or disrupt system availability by overwriting, deleting, or corrupting important files.

How does Absolute Path Traversal occur in real-world scenarios?

In a typical scenario, an attacker would provide malicious input containing absolute path sequences to the application, which would then use this input to construct a pathname that resolves outside of the restricted directory.

What are some common mitigations for Absolute Path Traversal?

Input validation and canonicalization can help prevent Absolute Path Traversal by ensuring that all input is properly sanitized and validated before being used in file operations.

How can developers detect Absolute Path Traversal vulnerabilities?

Developers can use a combination of manual testing, automated scanners (SAST/DAST), and PenScan’s detection capabilities to identify potential vulnerabilities.

What are some best practices for preventing Absolute Path Traversal?

Ensuring that all input is properly validated and sanitized, using allowlists instead of denylists, and implementing robust input validation mechanisms can help prevent Absolute Path Traversal.

How can developers fix Absolute Path Traversal vulnerabilities?

Developers can use a combination of input validation, canonicalization, and secure coding practices to address potential vulnerabilities.

Vulnerabilities Related to Absolute Path Traversal

Here are some related vulnerabilities:

References

• MITRE: https://cwe.mitre.org/data/definitions/36.html
• OWASP: https://owasp.org/Top10/A01_2025-Broken_Access_Control/
• CAPEC: https://capec.mitre.org/data/definitions/597.html
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Absolute Path Traversal and other risks before an attacker does.