# Path traversal in cache and file keys

User input joined into paths or URLs without canonicalization, escaping the intended namespace

_Area: Web infrastructure and server-side requests. Seen in 9 disclosed reports; 5 confirmed bounties, median $1,000, range $500-$3,495; latest 2026-10-07. Updated 2026-10-23._

## How it works
A request- or metadata-supplied value (digest, resource name, URL path, subdir, package name) is joined into a storage path or URL without normalization. The code assumes the value stays inside its namespace, but `../`, `::`, or a scheme quirk lets it climb out. The invariant that breaks: after canonicalization the resolved path must stay under the intended base, and the value used to build the key must equal the value used to fetch. Often the validator and the fetcher parse the same input differently, so a check on one representation does not constrain the other.

## Where it shows up
- String concatenation or `path.join` of user input into a path or URL
- Manifest `digest` or layer names used directly as on-disk blob paths [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-probllama-ollama-vulnerability-cve-2024-37032.md)
- Internal API proxy that strictly validates paths for a shared namespace but not per-deploy namespaces [E2](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-cloudflare-pages-privesc-and-page-tampering.md)
- Upload `subdir`/prefix params joined to a clone path, then walked and uploaded [E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-deno-registry-tampering-with-arbitrary-packages-en.md)
- Path checks that only cover some input types (string, Buffer) but not others [E4](https://bugbountylibrary.com/r/h1%3A2256167.md)
- Package metadata `name`/`version` fields used to build install paths [E5](https://bugbountylibrary.com/r/h1%3A243156.md)
- Custom separator substitution (`::` to `/`) in static/resource handlers [E6](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products.md)
- URL validators that allowlist the domain but regex-parse the path, so `../` survives [E7](https://bugbountylibrary.com/r/h1%3A1848940.md)
- Media pipelines that resolve playlist entries to local paths [E8](https://bugbountylibrary.com/r/h1%3A487008.md)

## How to review
Find every place a request-supplied string becomes a path segment or URL component. Confirm the value is canonicalized first (resolve `.`/`..`, decode, collapse separators), then prefix-compared against the base directory with a trailing separator so `/base` does not match `/base-evil`. Confirm the key used to store equals the key used to fetch, and that validators and fetchers share one parser. For archives and package installs, confirm extraction/install is confined to configured paths [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-probllama-ollama-vulnerability-cve-2024-37032.md)[E5](https://bugbountylibrary.com/r/h1%3A243156.md). Enumerate every input type the path API accepts, not just the ones a prior fix whitelisted [E4](https://bugbountylibrary.com/r/h1%3A2256167.md). For media, confirm transcoders cannot resolve local or external references [E8](https://bugbountylibrary.com/r/h1%3A487008.md).

## Variants seen
- Registry digest traversal to arbitrary file write and RCE [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-probllama-ollama-vulnerability-cve-2024-37032.md)
- Deploy API proxy traversal exposing other users' KV assets [E2](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-cloudflare-pages-privesc-and-page-tampering.md)
- Upload subdir traversal leaking secrets into public storage [E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-deno-registry-tampering-with-arbitrary-packages-en.md)
- Incomplete type coverage in a permission-model path check [E4](https://bugbountylibrary.com/r/h1%3A2256167.md)
- Package metadata name traversal overwriting another gem's binaries [E5](https://bugbountylibrary.com/r/h1%3A243156.md)
- Separator-substitution (`::`) traversal in web resources [E6](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products.md)
- Cache poisoning where the key resolves to the victim product but fetched content is the attacker's [E7](https://bugbountylibrary.com/r/h1%3A1848940.md)
- Local-file reference in a media playlist leaking file contents [E8](https://bugbountylibrary.com/r/h1%3A487008.md)

## Why fixes fail
Domain allowlisting without path normalization still permits traversal [E7](https://bugbountylibrary.com/r/h1%3A1848940.md). Fixes that whitelist specific input types leave other accepted types unchecked [E4](https://bugbountylibrary.com/r/h1%3A2256167.md).

## Impact and severity
Led to cross-tenant cache poisoning and code execution [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-probllama-ollama-vulnerability-cve-2024-37032.md)[E2](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-cloudflare-pages-privesc-and-page-tampering.md), credential and source disclosure [E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-deno-registry-tampering-with-arbitrary-packages-en.md)[E6](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products.md), arbitrary file write and RCE [E5](https://bugbountylibrary.com/r/h1%3A243156.md), user-visible cache poisoning [E7](https://bugbountylibrary.com/r/h1%3A1848940.md), and local file disclosure [E8](https://bugbountylibrary.com/r/h1%3A487008.md). Severity rises when unauthenticated, when the namespace is shared, and when the escaped path reaches secrets or executable locations.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-probllama-ollama-vulnerability-cve-2024-37032.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-cloudflare-pages-privesc-and-page-tampering.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-deno-registry-tampering-with-arbitrary-packages-en.md
- E4: https://bugbountylibrary.com/r/h1%3A2256167.md
- E5: https://bugbountylibrary.com/r/h1%3A243156.md
- E6: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products.md
- E7: https://bugbountylibrary.com/r/h1%3A1848940.md
- E8: https://bugbountylibrary.com/r/h1%3A487008.md