What is Path Traversal (CWE-26)?

Callout

TL;DR: Path Traversal (CWE-26) is a security misconfiguration vulnerability that occurs when a web application uses external input to construct a pathname that resolves outside of a restricted directory.

At-a-Glance

| Field | Value | |—|—| | CWE ID | CWE-26 | | OWASP Category | Not directly mapped | | CAPEC | None known | | Typical Severity | Critical | | Affected Technologies | Web applications, file systems | | Detection Difficulty | Moderate | | Last Updated | 2026-07-27 |

What is Path Traversal?

Path Traversal (CWE-26) is a type of security misconfiguration vulnerability that occurs when a web application uses external input to construct a pathname that resolves outside of a restricted directory.

As defined by the MITRE Corporation under CWE-26, and classified by the OWASP Foundation as Not directly mapped, Path Traversal is a critical vulnerability that can lead to unauthorized access or modification of sensitive data.

Quick Summary

Path Traversal (CWE-26) occurs when a web application uses external input to construct a pathname that resolves outside of a restricted directory. A successful attack can lead to unauthorized access or modification of sensitive data, including confidential information and system files. The best practices for preventing Path Traversal attacks include input validation, canonicalization, and secure configuration of file systems.

Jump to: At-a-Glance · What is Path Traversal? · Quick Summary · Path Traversal Overview · How Path Traversal Works · Business Impact of Path Traversal · Path Traversal Attack Scenario · How to Detect Path Traversal · How to Fix Path Traversal · Framework-Specific Fixes for Path Traversal · How to Ask AI to Check Your Code for Path Traversal · Path Traversal Best Practices Checklist · Path Traversal FAQ · Vulnerabilities Related to Path Traversal · References · Scan Your Own Site

Path Traversal Overview

What: Path Traversal (CWE-26) is a type of security misconfiguration vulnerability that occurs when a web application uses external input to construct a pathname that resolves outside of a restricted directory. Why it matters: A successful attack can lead to unauthorized access or modification of sensitive data, including confidential information and system files. Where it occurs: Path Traversal vulnerabilities typically occur in web applications that use external input to construct file paths. Who is affected: Any user who inputs data into the vulnerable application may be able to exploit this vulnerability. Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected.

How Path Traversal Works

Root Cause

The root cause of a Path Traversal attack is the use of external input to construct a pathname that resolves outside of a restricted directory.

Attack Flow

1. An attacker inputs malicious data into the vulnerable application.
2. The application uses the input data to construct a pathname that resolves outside of a restricted directory.
3. The attacker gains unauthorized access or modification of sensitive data.

Prerequisites to Exploit

• The attacker must be able to input data into the vulnerable application.
• The application must use external input to construct file paths.
• The attacker must know the directory structure and file names of the target system.

Vulnerable Code

import os

path = request.form['path']
os.chdir(path)

This code is vulnerable because it uses the request.form input directly as a path without any validation or canonicalization.

Secure Code

import os

path = request.form['path']
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')
os.chdir(path)

This code is secure because it uses the os.path.abspath function to canonicalize the input path and checks that it starts with a valid base directory before using it.

Business Impact of Path Traversal

Confidentiality: A successful attack can lead to unauthorized access or modification of sensitive data, including confidential information. Integrity: A successful attack can lead to unauthorized modification of system files and data. Availability: A successful attack can lead to disruption of system services and data availability.

Path Traversal Attack Scenario

1. An attacker inputs malicious data into the vulnerable application.
2. The application uses the input data to construct a pathname that resolves outside of a restricted directory.
3. The attacker gains unauthorized access or modification of sensitive data.

How to Detect Path Traversal

Manual Testing

• Test the application with different types of input, including malicious and unexpected characters.
• Verify that the application correctly handles errors and exceptions related to file system operations.
• Use tools like Burp Suite or ZAP to identify potential vulnerabilities.

Automated Scanners (SAST / DAST)

Automated scanners can detect Path Traversal vulnerabilities by analyzing code and identifying potential weaknesses. However, they may not catch all cases, especially those that involve complex directory structures or file names.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

False positives may occur when the pattern looks risky but is actually safe due to context a scanner can’t see. In such cases, manually review the code and consider the specific use case.

How to Fix Path Traversal

• Input validation: Verify that all input data is valid and sanitized before using it.
• Canonicalization: Use functions like os.path.abspath or Pathlib to canonicalize file paths and ensure they are within a restricted directory.
• Secure configuration of file systems: Ensure that file systems are properly configured to prevent unauthorized access or modification.

Framework-Specific Fixes for Path Traversal

Java

import java.io.File;

String path = request.getParameter("path");
File file = new File(path);
if (!file.getAbsoluteFile().startsWith(baseDir)) {
    throw new SecurityException("Invalid path");
}

This code is secure because it uses the getAbsolutePath method to canonicalize the input path and checks that it starts with a valid base directory before using it.

Node.js

const path = require('path');

let filePath = req.body.filePath;
if (!path.isAbsolute(filePath)) {
    throw new Error("Invalid file path");
}

This code is secure because it uses the isAbsolute method to check if the input path is absolute and throws an error if it’s not.

Python/Django

from pathlib import Path

path = request.POST.get('path')
if not Path(path).resolve().startswith(base_dir):
    raise ValueError('Invalid path')

This code is secure because it uses the Path.resolve method to canonicalize the input path and checks that it starts with a valid base directory before using it.

PHP

$path = $_POST['path'];
if (!is_absolute_path($path)) {
    throw new Exception("Invalid file path");
}

This code is secure because it uses the is_absolute_path function to check if the input path is absolute and throws an exception if it’s not.

How to Ask AI to Check Your Code for Path Traversal

You can use PenScan’s scanner engines to detect Path Traversal vulnerabilities in your web application. Here’s a copy-pasteable prompt you can use with an AI coding assistant:

Review the following Python code block for potential CWE-26 Path Traversal vulnerabilities and rewrite it using canonicalization:

import os

path = request.POST.get('path')
os.chdir(path)

Path Traversal Best Practices Checklist

✅ Always validate and sanitize user input before using it. ✅ Use functions like os.path.abspath or Pathlib to canonicalize file paths. ✅ Ensure that file systems are properly configured to prevent unauthorized access or modification.

Path Traversal FAQ

How does Path Traversal occur?

Path Traversal occurs when a web application uses external input to construct a pathname that resolves outside of a restricted directory, leading to unauthorized access or modification of files.

What are the consequences of a successful Path Traversal attack?

A successful Path Traversal attack can lead to unauthorized access or modification of sensitive data, including confidential information and system files.

How can I detect Path Traversal vulnerabilities in my web application?

You can use PenScan’s scanner engines to detect Path Traversal vulnerabilities in your web application.

What are the best practices for preventing Path Traversal attacks?

The best practices for preventing Path Traversal attacks include input validation, canonicalization, and secure configuration of file systems.

Can I use AI-powered tools to check my code for Path Traversal vulnerabilities?

Yes, you can use AI-powered tools like PenScan’s scanner engines to check your code for Path Traversal vulnerabilities.

What are the related CWEs to Path Traversal (CWE-26)?

The related CWEs to Path Traversal (CWE-26) include CWE-23: Relative Path Traversal, which is a more specific variant of CWE-26.

Vulnerabilities Related to Path Traversal

| CWE | Name | Relationship | |—|—|—| | CWE-23 | Relative Path Traversal | ChildOf |

References

• MITRE CWE-26
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Traversal and other risks before an attacker does.