Detect path traversal in file operations

Jun 25, 2026 · 1 min read

Concatenating a base path with user input is not safe; ../ and absolute paths escape it. Find file APIs that take request-derived names.

bash

grep -rEn "open(|readFile|File(|Paths.get|os.path.join|ioutil.ReadFile|sendFile" --include=*.{py,java,js,ts,go} .

The vulnerable join trusts the input.

javascript

res.sendFile(path.join(BASE, req.params.name));   // name="../../etc/passwd"

Pro note: the correct check resolves the final path and verifies it still starts with the base directory (canonicalization), not a blacklist of ../. Watch for decoders that run after the check, double URL-encoding, and null bytes on older runtimes.