# Path traversal in file path handling

User-controlled path reaching a file or object-store operation without normalization and confinement to a fixed base

_Area: Web access control and IDOR. Seen in 4 disclosed reports; one confirmed bounty: $1,500; latest 2026-08-28. Updated 2026-10-23._

## How it works
A path is built from user input (filename, path segment, metadata field) and handed to a file operation. The code assumes the input names something inside an intended directory, but nothing enforces that. Traversal sequences, absolute paths, or alternate spellings resolve outside the intended area. The broken assumption is that "the path we were given" and "the path we operate on" are the same after parsing and normalization.

## Where it shows up
- Filenames or path segments from request bodies, metadata, or query params used to build filesystem or object-store keys.
- Validators that branch on path type (relative/absolute/URL) and skip checks on some branches [E4](https://bugbountylibrary.com/r/h1%3A402473.md).
- Guards that compare two attacker-influenced paths to decide confinement [E1](https://bugbountylibrary.com/r/h1%3A3931777.md).
- Shared storage keyed by tenant prefix, with the key derived from user input [E3](https://bugbountylibrary.com/r/h1%3A94087.md).
- Error messages revealing internal directory layout, used as a discovery aid [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-exploiting-directory-traversal-on-a-yahoo-acquisition.md).
- Alternate path spellings (leading `//`, UNC/device forms) reaching local files [E4](https://bugbountylibrary.com/r/h1%3A402473.md).

## How to review
Trace every user-controlled value to each file open, delete, sign, or unlink. The invariant: after canonicalization, the resolved path must be provably inside the intended base directory, and the base must not be derived from the same input. Check that validation runs on the normalized path, not the raw string, and that every branch of a type-based validator applies the same checks. For object stores, confirm the final key is confined to the caller's prefix after normalization [E3](https://bugbountylibrary.com/r/h1%3A94087.md). For deletion sinks, confirm the containment directory is fixed, not computed from the target [E1](https://bugbountylibrary.com/r/h1%3A3931777.md).

## Variants seen
- Metadata field written verbatim, later used to derive a deletion target and its confinement dir [E1](https://bugbountylibrary.com/r/h1%3A3931777.md).
- Traversal in invoice/payment path segments exposing other users' data [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-exploiting-directory-traversal-on-a-yahoo-acquisition.md).
- Traversal in an S3 key escaping the tenant prefix, then signed for download [E3](https://bugbountylibrary.com/r/h1%3A94087.md).
- Absolute-path branch skipping extension validation [E4](https://bugbountylibrary.com/r/h1%3A402473.md).

## Impact and severity
Ranged from cross-tenant data read (credit card data [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-exploiting-directory-traversal-on-a-yahoo-acquisition.md), other shops' files [E3](https://bugbountylibrary.com/r/h1%3A94087.md)) to arbitrary file read [E4](https://bugbountylibrary.com/r/h1%3A402473.md) and arbitrary file deletion enabling site takeover [E1](https://bugbountylibrary.com/r/h1%3A3931777.md). Severity rises with shared storage, predictable identifiers enabling brute force [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-exploiting-directory-traversal-on-a-yahoo-acquisition.md), and sinks that delete or overwrite rather than read.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A3931777.md
- E2: https://bugbountylibrary.com/r/blog%3Asamcurry-net-exploiting-directory-traversal-on-a-yahoo-acquisition.md
- E3: https://bugbountylibrary.com/r/h1%3A94087.md
- E4: https://bugbountylibrary.com/r/h1%3A402473.md