Уязвимость обхода каталогов и несанкционированный доступ к файловой системе

Computer security vulnerability to gain unauthorized access to the file system
A directory traversal (or path traversal) attack exploits insufficient security validation or sanitization of user supplied file names, such that characters representing "traverse to parent directory" are passed through to the operating system's file system API. An affected application can be exploited to gain unauthorized access to the file system.

Another example is the Zip Slip vulnerability that affects several archive file formats like ZIP.

Directory traversal in its simplest form uses the / pattern. Some common variations are listed below:

Microsoft Windows and DOS directory traversal uses the \ or / patterns. Each partition has a separate root directory (labeled C:\ where C could be any partition), and there is no common root directory above that. This means that for most directory vulnerabilities on Windows, attacks are limited to a single partition. Directory traversal has been the cause of numerous Microsoft vulnerabilities.

Some web applications attempt to prevent directory traversal by scanning the path of a request URI for patterns such as /. This check is sometimes mistakenly performed before percent decoding, causing URIs containing patterns like %2e%2e/ to be accepted despite being decoded into / before actual use.

Percent decoding may accidentally be performed multiple times; once before validation, but again afterwards, making the application vulnerable to Double percent encoding attacks in which illegal characters are replaced by their double percent encoded form in order to bypass security countermeasures. For example, in a double percent encoding attack, / may be replaced by its double percent encoded form %252E%252E%252F. This kind of vulnerability notably affected versions 5.0 and earlier of Microsoft's IIS web server software.

A badly implemented UTF 8 decoder may accept characters encoded using more bytes than necessary, leading to alternative character representations, such as %2e and %c0%ae both representing This is specifically forbidden by the UTF 8 standard, but has still led to directory traversal vulnerabilities in software such as the IIS web server.