What Is Path Traversal (Directory Traversal)?

Path traversal is a weakness in which an application builds a filesystem path out of untrusted input and fails to keep the result inside the directory it meant to confine it to, so an attacker can read or write files elsewhere on the host. MITRE catalogues it as CWE-22, under the longer title Improper Limitation of a Pathname to a Restricted Directory.

MITRE treats path traversal as the preferred name and lists directory traversal as an accepted alternative, while noting that both describe the attack rather than the defect behind it. The defect itself is a failure to constrain a pathname, and the dot-dot-slash sequences the name evokes are only its best-known expression.

The Mechanics of a Path Traversal Attack

An application takes a filename from a request and joins it to a base directory before opening the result. Supplying a name that climbs out of that directory is enough, since the operating system resolves each step of a path in turn and has no opinion about which directory the developer had in mind.

MITRE splits the family in two, with relative traversal, CWE-23, walking upward from wherever the application started, and absolute traversal, CWE-36, skipping the base directory entirely by supplying a complete path of its own. A path traversal attack blocked in one of those forms can still land in the other, since validation written to catch an ascending path need not anticipate one that never ascends at all. Flaws of this shape are a standing feature of application assessments, which is why they appear in this catalogue of types of web application attacks.

Why Does Path Traversal Survive Detection?

Detection is not the obstacle, which makes this weakness unusual. Eight of the nine detection methods MITRE lists against it are rated highly effective. The list runs through automated static analysis of source and compiled code, manual review of source, automated and manual dynamic analysis, and architecture or design review. Manual inspection of compiled code is the single exception. MITRE also rates the likelihood of exploit as high, a combination that should make the class rare.

It is not rare at all, since the weakness ranks sixth in the 2025 CWE Top 25 on a score of 8.99, ahead of use-after-free, out-of-bounds read, and both the OS command injection and code injection entries. Something other than detection capability is keeping it in shipped software.

Path Validation Has No Clean Answer

MITRE locates the difficulty in pathname equivalence, which it describes as a species of canonicalization error, and deciding whether two strings name the same file turns out to be hard. The guidance notes that any combination of directory separators and dot counts produces its own variant to be handled.

Encodings multiply those variants further, since a separator can arrive percent-encoded, double-encoded, or expressed in an alternative character encoding, and a symbolic link can point anywhere regardless of how the path reaching it was spelled. A filesystem that treats upper and lower case as equivalent adds another layer, and so does one that quietly strips trailing characters. The variants are not a finite list.

Advisories compound the problem, because MITRE observes that incomplete diagnosis or reporting can leave the affected variant unidentified, so a team reading a report may not learn whether the control it already has covers the case being described.

Validation order is the trap, because checking the string that arrived and decoding it only afterwards inspects something the filesystem will never see. MITRE's instruction runs the other way, decoding and canonicalizing the input first and validating only what that process produces.

How to Fix a Path Traversal Vulnerability

A Secure by Design Alert issued on 2 May 2024 by CISA together with the FBI counted 55 directory traversal entries across CISA's catalog of exploited vulnerabilities and named two of them, CVE-2024-1708 and CVE-2024-20345. The alert states plainly that the approaches for avoiding these flaws are already known, which puts the persistence of the class on the manufacturers shipping it.

The control that holds is the platform's own canonicalization function. A call to realpath, or whatever an environment offers in its place, resolves the upward sequences and follows symbolic links to produce one authoritative path. That path can then be tested for containment inside the permitted base directory before anything is opened.

MITRE is direct about the control to distrust, warning against any mechanism that depends on stripping dangerous characters. A filter has to anticipate every spelling of every separator, while a containment check on a resolved path has to be right once. Assigning the file an internal identifier, and never letting a caller-supplied name reach the filesystem at all, removes a path traversal vulnerability instead of filtering for it.

Every fix above depends on the application running a check it was supposed to run. Raven Runtime Prevention runs it from inside the process instead, at the moment a file is opened, so the resolved path gets tested whether or not the code thought to test it. See it in Runtime Prevention.

‍