# Privileged write path traversal

User-controlled name joined into a privileged path; check canonicalization vs. how the writer resolves it

_Area: Memory corruption and native code. Seen in 5 disclosed reports; 3 confirmed bounties, median $6,000, range $2,500-$13,337; latest 2026-04-29. Updated 2026-10-23._

## How it works
A privileged component (root/SYSTEM service, updater, sandbox policy, management appliance) builds a filesystem path by joining a trusted base directory with a name it does not fully control. The name is assumed to be a single harmless segment. That assumption breaks when the name contains traversal sequences, an absolute path, a drive letter, or a separator the joiner honors differently than the checker. The write then lands outside the intended directory, as the privileged user. The unifying invariant is check-vs-use: whatever the security check resolves must be exactly what the writer resolves.

## Where it shows up
- Filename taken from a URL's last path segment, a remote metadata field, or an object name, then concatenated or passed to `Path.Combine`/`path.resolve` [E3](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md)[E5](https://bugbountylibrary.com/r/h1%3A2995025.md)
- Windows backslash paths embedded in a URL, or `..\..\` in a remote-supplied name [E3](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md)[E5](https://bugbountylibrary.com/r/h1%3A2995025.md)
- Config/INI fields naming a plugin or driver treated as a bare name but resolved as a path, including UNC shares [E6](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md)
- Debug/hot-reload/inspector commands fetching remote URLs into local paths [E5](https://bugbountylibrary.com/r/h1%3A2995025.md)
- A security check canonicalizes a path while the loader treats it as an opaque entry name (`.jar/` split) [E1](https://bugbountylibrary.com/r/h1%3A3452696.md)

## How to review
Find every privileged write sink (file create/rename, DLL/driver load, archive extract) and trace the name back to its source. The invariant: the resolved, canonical destination must remain inside the intended base directory, and the same resolution must be used by both the check and the write. Verify the code rejects `..`, absolute paths, drive letters, and both `/` and `\` separators, and that it uses a captured local reference to the resolver, not a monkey-patchable property. For archive/entry names, confirm the checker and loader agree on split points [E1](https://bugbountylibrary.com/r/h1%3A3452696.md). Note that E1 is a check-vs-use divergence rather than classic `../`: the check and the consumer disagree on how the same string resolves.

## Variants seen
- URL filename into `Path.Combine` overriding parent with a full Windows path [E3](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md)
- Concatenation of `path.fileName()` into a temp path, `..\..\` escaping [E5](https://bugbountylibrary.com/r/h1%3A2995025.md)
- INI driver name used as path, loading DLL from UNC share [E6](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md)
- Policy canonicalizes URL while JAR loader treats remainder as literal nested entry [E1](https://bugbountylibrary.com/r/h1%3A3452696.md)

## Why fixes fail
Fixing one handler leaves sibling commands in the same debug/inspector surface exploitable [E5](https://bugbountylibrary.com/r/h1%3A2995025.md).

## Impact and severity
Arbitrary file write as root/SYSTEM leading to RCE, sandbox escape, and implant deployment [E3](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md)[E5](https://bugbountylibrary.com/r/h1%3A2995025.md)[E6](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md). Severity rises when the writer runs privileged and the name is remotely supplied.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A3452696.md
- E2: https://bugbountylibrary.com/r/blog%3Abreachproof-net-blog-lethal-injection-how-we-hacked-microsoft-ai-chat-bot.md
- E3: https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md
- E4: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-cve-2026-31431-copy-fail-exploit-detection-with-agents.md
- E5: https://bugbountylibrary.com/r/h1%3A2995025.md
- E6: https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md
- E7: https://bugbountylibrary.com/r/h1%3A544096.md
- E8: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dismantling-smart-app-control.md