Client-Side Path Traversal (CSPT)

What Is Broken and Why

Client-Side Path Traversal occurs when attacker-controlled input is concatenated directly into the path component of a JavaScript fetch() or XHR URL without proper encoding. The injected ../ sequences traverse the URL path, redirecting the request to an unintended endpoint. Unlike server-side path traversal (which reads files), CSPT redirects API calls — enabling response injection, data exfiltration, and XSS when chained with an open redirect that fetch() auto-follows to an attacker-controlled domain.

Key Signals