# Local file read at https://████/ [HtUS]

download.php's filePathDownload parameter lacked traversal filtering, letting an attacker read arbitrary local files like /etc/passwd and PHP source.

- Payout: hidden
- Severity: critical
- Program: U.S. Dept Of Defense
- Found by: sudi
- Disclosed: 2022-10-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1626210
- Library page: https://bugbountylibrary.com/r/h1%3A1626210
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical technique:incomplete-fix technique:source-review vuln:info-disclosure vuln:path-traversal

**Target:** PHP download endpoint (download.php)
**Root cause:** checkPath() only verifies the string contains 'data_products' via strpos, so a path like data_products/../../etc/passwd passes the check while traversing outside the intended directory.
**Steps:**
1. Request `GET /download.php?filePathDownload=data_products/../../../../../etc/passwd`
2. Observe /etc/passwd contents returned
3. Read source via `filePathDownload=data_products/../download.php`
**How found:** Researcher revisited a previously reported endpoint (report #1542734) that returned 403, and found a bypass by keeping 'data_products' in the path while appending traversal sequences.
**Exploitation:** Attacker sends a crafted filePathDownload value containing 'data_products' plus ../ sequences; the contains() check passes and readfile() streams the target file to the attacker.
**Insight:** When a filter only checks substring presence (strpos contains), satisfy the substring at the start and append ../ to escape; also read the endpoint's own source via the same traversal to confirm the filter logic.