What is a Path Traversal Vulnerability? Explained for UK Businesses

What is a path traversal vulnerability? Explained for UK businesses

A path traversal vulnerability — also called a directory traversal attack — allows an attacker to read files on your web server that they should have no access to. In some cases it also allows them to write files, which can lead to complete server compromise.

How path traversal works

When your website serves files based on user input — for example, a URL like /download?file=report.pdf — the application takes the filename from the request and retrieves that file from the server.

A path traversal attack works by manipulating that filename to navigate up the directory structure. The characters ../ mean "go up one level" in a file path. If the application does not validate or sanitise the filename, an attacker can send something like:

/download?file=../../../etc/passwd

This instructs the server to go up three directory levels and retrieve the system's password file — a file that contains usernames for every account on the server.

What attackers can access

Depending on the server configuration and how far the traversal is permitted, attackers may be able to read:

Server configuration files that contain database passwords and API keys. Application source code that reveals how the system works. User data files including uploaded documents. System files that reveal server structure and installed software. Log files that contain sensitive information.

Who is at risk

Websites that serve files based on user-supplied filenames are at risk. This includes download pages, document viewers, image loaders, file management systems, and any functionality where users can specify which file they want to retrieve.

Custom-built web applications are at higher risk than standard CMS platforms like WordPress or Shopify, which have their own file-serving logic. However, plugins and extensions on any platform can introduce path traversal vulnerabilities.

How it is prevented

The fix is to validate all file paths server-side. This means checking that the resolved file path starts with the expected base directory, rejecting any input that contains ../ or similar traversal sequences, and using an allowlist of permitted filenames where possible.

Does Yrzo AI test for path traversal?

Yes. Yrzo AI includes path traversal testing in its 44 automated security checks, sending traversal payloads to URL parameters and form fields that accept file inputs, and checking whether the server returns file contents it should not. Starting at £399 for a full report.