45
(e.g. a trailing "/" on a filename could bypass access rules that don't expect a trailing /, causing a
server to provide the file when it normally would not).
Terminology
Like other weaknesses, terminology is often based on the types of manipulations used, instead
of the underlying weaknesses. Some people use "directory traversal" only to refer to the injection
of ".." and equivalent sequences whose specific meaning is to traverse directories. Other variants
like "absolute pathname" and "drive letter" have the *effect* of directory traversal, but some
people may not call it such, since it doesn't involve ".." or equivalent.
Research Gap
Many variants of path traversal attacks are probably under-studied with respect to root cause.
CWE-790 and CWE-182 begin to cover part of this gap.
Research Gap
Incomplete diagnosis or reporting of vulnerabilities can make it difficult to know which variant is
affected. For example, a researcher might say that "..\" is vulnerable, but not test "../" which may
also be vulnerable. Any combination of directory separators ("/", "\", etc.) and numbers of "." (e.g.
"....") can produce unique variants; for example, the "//../" variant is not listed (CVE-2004-0325).
See this entry's children and lower-level descendants.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Path Traversal
OWASP Top Ten 2007 A4 CWE More Specific Insecure Direct Object Reference
OWASP Top Ten 2004 A2 CWE More Specific Broken Access Control
CERT C Secure Coding FIO02-C Canonicalize path names originating
from untrusted sources
SEI CERT Perl Coding
Standard
IDS00-
PL
Exact Canonicalize path names before
validating them
WASC 33 Path Traversal
Software Fault Patterns SFP16 Path Traversal
OMG ASCSM ASCSMCWE-