Directory Traversal and Path Traversal: Accessing Files Outside the Web Root — 日本企業向けガイド

Directory traversal (path traversal) vulnerabilities allow attackers to access files outside the intended directory — reading configuration files, source code, credentials, or system files like /etc/passwd. Testing covers: basic traversal sequences (../), encoding bypasses (URL encoding, double encoding, null bytes), absolute path injection, file inclusion vulnerabilities (local and remote), and traversal through file upload features. Despite being well-known, path traversal remains common because applications often construct file paths from user input in ways that bypass web framework protections.