path-traversal

To detect directory traversal vulnerabilities, you need to scan for relative and encoded traversal paths, mixed separators, and archive traversal payloads within user input leading to filesystem operations. This process verifies that path confinement and canonicalization controls prevent unauthorized file read or write outside allowed directories.

An archive traversal vulnerability, such as ZipSlip or TarSlip, occurs when archive extraction APIs allow relative traversal paths to escape the intended target directory. Detecting it requires probing archive extraction inputs for malicious payloads and verifying that canonicalization confines the extracted paths to the allowed root directory.

To verify path confinement controls for filesystem operations, you must check that canonicalization is applied to user input and validate that unauthorized file read or write operations are blocked outside allowed directories using both positive and negative controls.

When auditing directory traversal security, you should test payload classes including relative traversal, encoded traversal, mixed separators, and archive traversal payloads. These payloads probe file download endpoints, send_file functions, and open operations to bypass path confinement.

Yes, this vulnerability detection approach explicitly checks for encoded traversal paths and mixed separators. It probes user input leading to filesystem operations to ensure that canonicalization and path confinement controls successfully mitigate these directory traversal techniques.