sast-pathtraversal

Detect path traversal vulnerabilities by tracing user-controlled path inputs through file operations and archive extraction. The analysis identifies dynamic file path usage across Python, Node.js, PHP, Java, and Go stacks, validating findings against safe mitigation patterns.

A path traversal vulnerability in archive extraction occurs when user-controlled input influences filesystem paths used for reading, writing, or serving files. This happens when archival operations unpack user-supplied content without verifying dynamic path boundaries.

Check file path construction mitigation by verifying the use of realpath with prefix checks, basename filtering, and safe framework helpers. The analysis confirms whether your code conforms to these robust patterns and reports deviations.

Yes, you need an architectural analysis before running a path traversal assessment. The sast/architecture.md file must exist to supply the necessary architectural context for locating and validating traversal findings across your codebase.

Path traversal static analysis works with PHP and Go applications, along with Python, Node.js, and Java. It traces user-controlled path inputs across these stacks to locate dynamic file usage and archival operations.

Path traversal vulnerability scan results output to sast/pathtraversal-results.md. This structured report provides actionable remediation guidance by consolidating findings from the locate, validate, and merge analysis phases.