Path Traversal & Zip Slip Detection

When to Use

Audit archive extraction libraries, file upload handlers, static file servers, file path utilities, and any package that writes files based on user-controlled names.

~85% CVE acceptance rate when confirmed.

Key Insight

path.join() does NOT prevent .. traversal in Node.js:

path.join('/uploads', '../../../etc/passwd')
// Returns: '/etc/passwd' -- NOT '/uploads/etc/passwd'

path.resolve() returns an absolute path but also does NOT validate that it stays within a base directory.

Variants