# Path traversal via config and listing

Scheme-agnostic path helpers, config include directives, and directory listings resolving paths outside the intended root

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; one confirmed bounty: $500; latest 2026-09-08. Updated 2026-11-02._

## How it works
A component resolves a path from data it does not fully control, and the resolution step is not confined to the intended root. The broken assumption is that a path, host, or include target is trusted or already contained. Three shapes: a URL-scheme-agnostic helper (DNS SRV) applied to schemes like `file://` where host semantics differ [E1](https://bugbountylibrary.com/r/h1%3A411519.md); a config parser that follows `[include]` directives in an attacker-supplied file with no containment check [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-7833-fr7j-v32q.md); and access control applied only to the root path while subpaths stay listable [E3](https://bugbountylibrary.com/r/h1%3A301812.md). In each case the resolver trusts an input the attacker can shape, so the resolved path escapes the root.

## Where it shows up
- Helpers that run for every source scheme (SRV lookup, redirect, host rewrite) including `file://`/`s3://` [E1](https://bugbountylibrary.com/r/h1%3A411519.md)
- Config parsers with `merge_includes`/include support reading attacker-controlled files (`.gitmodules`) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-7833-fr7j-v32q.md)
- Sibling call sites of a parser class where one was hardened and others were not [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-7833-fr7j-v32q.md)
- Root path returns 403 but subpaths (`/WEB-INF/`, `/META-INF/`) are reachable and listable [E3](https://bugbountylibrary.com/r/h1%3A301812.md)
- Directory listing enabled on servlet metadata directories [E3](https://bugbountylibrary.com/r/h1%3A301812.md)

## How to review
Find every place a path is resolved from external data and ask: is the resolved result confined to the intended root? The invariant: after resolution, the final path must lie under the allowed base, and scheme/host semantics must not let an attacker inject path components. Check that include directives are disabled or containment-checked on attacker-controlled files [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-7833-fr7j-v32q.md), that scheme-specific helpers skip schemes where host is meaningless [E1](https://bugbountylibrary.com/r/h1%3A411519.md), and that ACLs cover subpaths, not just the root [E3](https://bugbountylibrary.com/r/h1%3A301812.md).

## How finders spotted it
- Noticed `api_endpoint` ran for all schemes including `file://`, and that a prior PR let SRV responses modify path components; empty host in `file://` made the SRV query predictable [E1](https://bugbountylibrary.com/r/h1%3A411519.md)
- Saw maintainers hardened `Repo.config_writer()` against `merge_includes` but never touched `Submodule._config_parser()`; git blame showed the call unchanged, and reading `_included_paths()`/`read()` confirmed absolute paths short-circuit containment [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-7833-fr7j-v32q.md)
- Scanned all in-scope subdomains, saw root 403, hypothesized the ACL was path-scoped, then probed standard Java metadata dirs [E3](https://bugbountylibrary.com/r/h1%3A301812.md)

## Variants seen
- SRV target injecting a path prefix into `file://` fetches [E1](https://bugbountylibrary.com/r/h1%3A411519.md)
- `[include]` in untrusted `.gitmodules` reading arbitrary local files [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-7833-fr7j-v32q.md)
- Path-scoped ACL plus directory listing exposing compiled artifacts [E3](https://bugbountylibrary.com/r/h1%3A301812.md)

## Impact and severity
E1 enabled local gem hijacking via DNS spoofing. E2 disclosed arbitrary local file content, doubling as a file-existence oracle; targeting `.env` or single-line credential files yields secrets directly. E3 leaked full source via decompiled `.class`/`.jar`. Severity rises when the primitive reaches secrets or source and when the resolver is reachable without authentication.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **GitPython (pip)** <= 3.1.58, fixed in 3.1.59: GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigPars (CVE-2026-78675). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-7833-fr7j-v32q.md. Fix: https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A411519.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-7833-fr7j-v32q.md
- E3: https://bugbountylibrary.com/r/h1%3A301812.md