Path Traversal and File Inclusion

What Is Broken and Why

Applications that construct file paths from user-supplied input without proper canonicalization and boundary enforcement allow attackers to escape the intended directory. On Linux/Unix, this enables reading /etc/passwd, SSH keys, application configuration files, and source code. On Windows, boot.ini, win.ini, and SAM hive files become accessible. Remote File Inclusion (RFI) extends the impact to arbitrary code execution by loading attacker-controlled URLs as server-side scripts. Inadequate sanitization — including blacklisting only specific sequences — is routinely bypassed through encoding variants.

Key Signals