Glossary: Endpoint, Application and Email Security

directory traversal

Also written: path traversal, ../

An attack that uses ../ sequences, or encoded forms such as %2e%2e%2f, in a file name to reach files outside the intended folder, such as ../../etc/passwd. The fix is to canonicalize the name, then accept it only from an allow list of files or only if it stays inside the permitted folder.