Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
CWE-23 Base Draft
Relative Path Traversal
This vulnerability occurs when an application builds file paths using user-supplied input without properly validating or sanitizing it. Attackers can exploit this by inserting special directory…
Definition
What is CWE-23?
This vulnerability occurs when an application builds file paths using user-supplied input without properly validating or sanitizing it. Attackers can exploit this by inserting special directory traversal sequences like '..' to access files and directories outside the intended restricted folder.
Path traversal, often called directory traversal, is a critical security flaw where an attacker manipulates file path inputs to break out of the application's intended directory. By using sequences like '../' (or its encoded equivalents), they can navigate to sensitive system files, configuration files, source code, or other restricted data. This typically happens when file operations—such as reading, writing, or deleting—rely on unsanitized user input from URLs, form fields, or cookies to construct the final path.
To prevent this, developers must implement strict validation using allowlists of permitted files or directories, rather than trying to block malicious patterns. All user input used in file system operations should be canonicalized and then checked against a base directory path to ensure the final resolved path stays within the intended safe location. Server configuration should also enforce proper permissions, limiting the application's access to only necessary directories.
Auswirkungen in der Praxis
Real-world CVEs caused by CWE-23
-
Large language model (LLM) management tool does not validate the format of a digest value (CWE-1287) from a private, untrusted model registry, enabling relative path traversal (CWE-23), a.k.a. Probllama
-
Product for managing datasets for AI model training and evaluation allows both relative (CWE-23) and absolute (CWE-36) path traversal to overwrite files via the Content-Disposition header
-
Chain: a learning management tool debugger uses external input to locate previous session logs (CWE-73) and does not properly validate the given path (CWE-20), allowing for filesystem path traversal using "../" sequences (CWE-24)
-
Python package manager does not correctly restrict the filename specified in a Content-Disposition header, allowing arbitrary file read using path traversal sequences such as "../"
-
directory traversal in Go-based Kubernetes operator app allows accessing data from the controller's pod file system via ../ sequences in a yaml file
-
a Kubernetes package manager written in Go allows malicious plugins to inject path traversal sequences into a plugin archive ("Zip slip") to copy a file outside the intended directory
-
Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.
-
Go-based archive library allows extraction of files to locations outside of the target folder with "../" path traversal sequences in filenames in a zip file, aka "Zip Slip"
Wie Angreifer es ausnutzen
Angreiferpfad Schritt für Schritt
- 1
The following URLs are vulnerable to this attack:
- 2
A simple way to execute this attack is like this:
- 3
The following code could be for a social networking application in which each user's profile information is stored in a separate file. All files are stored in a single directory.
- 4
While the programmer intends to access files such as "/users/cwe/profiles/alice" or "/users/cwe/profiles/bob", there is no verification of the incoming user parameter. An attacker could provide a string such as:
- 5
The program would generate a profile pathname like this:
Verwundbares Codebeispiel
Vulnerable Other
The following URLs are vulnerable to this attack:
http://example.com/get-files.jsp?file=report.pdf
http://example.com/get-page.php?home=aaa.html
http://example.com/some-page.asp?page=index.html Angreifer-Payload
A simple way to execute this attack is like this:
http://example.com/get-files?file=../../../../somedir/somefile
http://example.com/../../../../etc/shadow
http://example.com/get-files?file=../../../../etc/passwd Sicheres Codebeispiel
Secure HTML
The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.
<form action="FileUploadServlet" method="post" enctype="multipart/form-data">
Choose a file to upload:
<input type="file" name="filename"/>
<br/>
<input type="submit" name="submit" value="Submit"/>
</form> What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Präventions-Checkliste
How to prevent CWE-23
- Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434. Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
- Implementation Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked. Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes: - realpath() in C - getCanonicalPath() in Java - GetFullPath() in ASP.NET - realpath() or abs_path() in Perl - realpath() in PHP
- Operation Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Erkennungssignale
How to detect CWE-23
Plexicus erkennt CWE-23 automatisch und öffnet in unter 60 Sekunden einen Fix-PR.
Codex Remedium scannt jeden Commit, identifiziert genau diese Schwachstelle und liefert einen reviewer-ready Pull Request mit dem Patch. Keine Tickets. Keine Hand-offs.
Häufig gestellte Fragen Was ist CWE-23?
Wie gravierend ist CWE-23?
Welche Sprachen oder Plattformen sind von CWE-23 betroffen?
Wie kann ich CWE-23 verhindern?
Wie erkennt und behebt Plexicus CWE-23?
Wo erfahre ich mehr über CWE-23?
Frequently asked questions
Was ist CWE-23?
This vulnerability occurs when an application builds file paths using user-supplied input without properly validating or sanitizing it. Attackers can exploit this by inserting special directory traversal sequences like '..' to access files and directories outside the intended restricted folder.
Wie gravierend ist CWE-23?
MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.
Welche Sprachen oder Plattformen sind von CWE-23 betroffen?
MITRE lists the following affected platforms: AI/ML.
Wie kann ich CWE-23 verhindern?
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and…
Wie erkennt und behebt Plexicus CWE-23?
Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-23 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.
Wo erfahre ich mehr über CWE-23?
MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/23.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.
Verwandte Schwachstellen
Weaknesses related to CWE-23
CWE-22 Parent
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
This vulnerability occurs when an application builds a file path using user input but fails to properly validate it, allowing an attacker…
CWE-36 Sibling
Absolute Path Traversal
This vulnerability occurs when an application builds file paths using user input without properly blocking absolute paths like…
CWE-24 Child
Path Traversal: '../filedir'
Path traversal, often called directory traversal, occurs when an application builds a file path using user input without properly blocking…
CWE-25 Child
Path Traversal: '/../filedir'
This vulnerability, often called directory traversal, occurs when an application builds a file path using user input without properly…
CWE-26 Child
Path Traversal: '/dir/../filename'
This vulnerability occurs when an application builds a file path using user input but fails to properly block directory traversal…
CWE-27 Child
Path Traversal: 'dir/../../filename'
This vulnerability occurs when an application builds file paths using user input but fails to properly block sequences like…
CWE-28 Child
Path Traversal: '..\filedir'
This vulnerability occurs when an application builds a file path using user input but fails to block or properly handle '..\' sequences.…
CWE-29 Child
Path Traversal: '\..\filename'
This vulnerability occurs when an application builds file paths using user input but fails to block '\..\filename' sequences. Attackers…
CWE-30 Child
Path Traversal: '\dir\..\filename'
This vulnerability occurs when an application builds file paths using user input but fails to properly sanitize sequences like…
Ressourcen
Further reading
- MITRE — offizielle CWE-23 https://cwe.mitre.org/data/definitions/23.html
- OWASP Attack listing http://www.owasp.org/index.php/Relative_Path_Traversal
- Zip Slip Vulnerability https://security.snyk.io/research/zip-slip-vulnerability
- Secure by Design Alert: Eliminating Directory Traversal Vulnerabilities in Software https://www.cisa.gov/resources-tools/resources/secure-design-alert-eliminating-directory-traversal-vulnerabilities-software
- D3FEND: Application Layer Firewall https://d3fend.mitre.org/dao/artifact/d3f:ApplicationLayerFirewall/
Bereit, wenn du es bist
Schluss mit dem Bezahlen pro Entwickler.
Schließ den Kreislauf.
Plexicus ist die KI-native ASPM, die scannt, filtert, fixt, pentestet und erklärt — autonom. Unbegrenzte Entwickler, unbegrenzte Repos, Fair-Use-KI-Aktionen. Echter kostenloser Tarif, €269/mo jährlich, wenn du bereit bist.