Path traversal
A filename or URL uses ../ or an equivalent trick to escape the intended folder and make the server open a different file.
See it
What it is
Path traversal happens when untrusted input becomes part of a filesystem path and escapes the directory the application intended to expose. The classic payload uses ../ segments to walk upward, then names a file such as /etc/passwd. Encoded separators, absolute paths, Windows backslashes, and archive entries can reach the same result without the literal string the developer expected. The archive case has its own name, Zip Slip: an entry stored as ../../etc/cron.d/job writes outside the extraction directory the moment you unzip it.
Reach for it around download routes, template names, static-file helpers, archive extraction, image processors, and any API accepting a filename. The safest design maps an opaque record id to a server-owned path instead of accepting a path at all. If a path is unavoidable, canonicalize it and prove the resolved target remains beneath one fixed base directory.
Deleting ../ once is not enough. Percent encoding can hide separators until a later decode, and symbolic links can point an apparently safe child outside the base after a string check. Decode exactly once, reject absolute paths and null bytes, use fs.realpath for existing targets, and test both POSIX and Windows path forms if the code can run on both.
Ask AI for it
Fix path traversal in this Node.js file endpoint. Replace client-supplied paths with opaque database ids where possible. Otherwise decode the input exactly once, reject null bytes and absolute POSIX or Windows paths, use path.resolve and path.relative against one fixed base directory, and reject a relative result that is absolute, equals '..', or begins with '..' plus path.sep. For existing files, compare fs.realpath results so a symbolic link cannot escape the base. Do not rely on stripping '../'. Add tests for plain and percent-encoded traversal, mixed separators, doubled encoding, absolute paths, sibling-prefix paths, null bytes, and symlinks, asserting every case outside the base returns 400 or 404 without revealing the resolved server path.