Skip to content

Path Traversal due to Unsafe File Access

Description

Detected potential file path traversal via user-controlled input. Attackers may use "../" to access sensitive files.

Examples

Insecure Code

java
File file = new File("/static/", request.getParameter("file"));

Secure Code

java
File file = new File("/static/", FilenameUtils.getName(request.getParameter("file")));

Remediation

Use `FilenameUtils.getName(...)` to sanitize input.

Rule Details

FieldValue
IDCODE-0212
CategoryInjection
SeverityCRITICAL
CWECWE-22
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityEASY
Tagspath traversal, file access
OWASPA01:2021-Broken Access Control