# Ad Builder Display Ads Path Traversal

Semrush Ad Builder zip extractor and data.csv image fields allow path traversal, letting attackers write files outside the unpack dir and reference arbitrary system images.

- Payout: hidden
- Severity: medium
- Program: Semrush
- Found by: ajxchapman
- Disclosed: 2020-02-28
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/316713
- Library page: https://bugbountylibrary.com/r/h1%3A316713
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:file-upload vuln:path-traversal

**Target:** Ad Builder Display Ads zip import / data.csv processor
**Root cause:** Zip entry filenames and data.csv Image/Square image/Logo/Landscape logo fields are used as filesystem paths without sanitizing `../` sequences, so extraction and image reads escape the intended unpack directory.
**Steps:**
1. Create a Semrush project, open Ad Builder -> Display Ads -> New Ad -> From File.
2. Craft zip with entry `../1.png` plus a `data.csv`; upload it.
3. Observe `1.png` written outside `ab_<api key>_<project id>_displayAds.tmp.unpack/` (path leaked via JSON-RPC error `mkdir .../link: not a directory`).
4. Craft `data.csv` with `Image` field `../../../usr/share/pixmaps/debian-logo.png`; upload zip with no images.
5. Observe produced advert references the pre-existing system image, confirming arbitrary file read into the ad.
**How found:** Noticed JSON-RPC error messages leaking the full unpack path, then hypothesized zip-slip on entry names and path traversal in CSV image fields, testing with `../` payloads and a known Debian logo path.
**Exploitation:** Attacker uploads a zip whose entry names contain `../` to write arbitrary files into writable directories, then a second zip whose data.csv image fields traverse to reference those files or existing system files, embedding them in the generated advert.
**Escalation:** Potential escalation to full compromise by writing scripts/executables to auto-executed directories, though only `/███/████████` was found writable.
**Insight:** Error messages from the extraction backend leaked the absolute unpack directory, enabling precise `../` depth calculation; also test every CSV field that names a file (image/logo variants), not just the obvious one.