https://nalar.dev/tags/path-traversal/ Recent content in Path Traversal on Nalar Hugo en-us Fri, 04 Sep 2026 00:00:00 +0700 https://nalar.dev/keep-file-access-inside-an-intended-directory/ Fri, 04 Sep 2026 00:00:00 +0700 https://nalar.dev/keep-file-access-inside-an-intended-directory/ <p>Applications often let a caller identify a file: download an invoice, open an exported report, read a template, or retrieve an uploaded document. The dangerous version of this design treats a caller-controlled path as if it were already a permitted file.</p> <p>A path can describe movement through a filesystem, not just a filename. If untrusted input is combined with an application directory without a reliable containment check, the resulting path may resolve somewhere outside that directory. A read operation can expose configuration or private data; a write or delete operation can have more serious consequences.</p>