# Path traversal chained to code execution

Traversal or arbitrary file read/write that reaches an executable path, config loader, or credential store

_Area: Web injection and code execution. Seen in 2 disclosed reports; latest 2024-06-18. Updated 2026-10-24._

## How it works
A path or filename is treated as trusted data, but the attacker controls it. The code joins it to a base directory or appends a fixed extension without normalizing, so `..` segments, absolute paths, or truncation characters escape the intended location. The write or read then lands somewhere the runtime later executes or trusts: a shell-sourced config, an app bundle, or a credential file. The broken assumption is that "the path stays inside our directory" and "the file we write is data, not code."

## Where it shows up
- User-controlled config spread after a default path (e.g. `{...defaults, ...userConfig}`) so the DB/file location is attacker-chosen [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-x3hf-7cj6-3r4m.md)
- Filename parsing on received archives with no canonicalization before extraction [E2](https://bugbountylibrary.com/r/h1%3A727727.md)
- Fixed extension appended to attacker filename; `#`, `?`, or null truncates it [E2](https://bugbountylibrary.com/r/h1%3A727727.md)
- Web routes with `../` segments reaching static handlers, e.g. `/dana-na/../dana/html5acc/...` [E3](https://bugbountylibrary.com/r/h1%3A696276.md)
- Files written into directories a privileged process sources as shell or config [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-x3hf-7cj6-3r4m.md)
- Cleartext credentials in readable files that unlock a second stage [E3](https://bugbountylibrary.com/r/h1%3A696276.md)

## How to review
Trace every attacker-influenced path to its sink. The invariant: after resolution, the canonical absolute path must remain under the intended base directory, and the written file must never be interpreted as code or config by a privileged process. Check that normalization happens after all decoding and extension logic, that config merges cannot override security-relevant paths, and that the process does not run as root with a shell-sourced config directory. For reads, confirm the file cannot contain credentials or secrets that grant a further stage.

## Variants seen
- Config-override traversal: user config sets SQLite path into a root-sourced Chromium config dir, yielding root RCE [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-x3hf-7cj6-3r4m.md)
- Archive filename traversal plus extension truncation, executing a pre-installed app; blacklist missed `.terminal` [E2](https://bugbountylibrary.com/r/h1%3A727727.md)
- Pre-auth traversal file read exposing cleartext credentials, chained to post-auth command injection to root [E3](https://bugbountylibrary.com/r/h1%3A696276.md)

## Impact and severity
All three reached code execution or full compromise, the highest severity. Severity rose when the sink ran as root [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-x3hf-7cj6-3r4m.md), when a blacklist was incomplete [E2](https://bugbountylibrary.com/r/h1%3A727727.md), and when a file read alone yielded reusable credentials [E3](https://bugbountylibrary.com/r/h1%3A696276.md). Unauthenticated reachability [E3](https://bugbountylibrary.com/r/h1%3A696276.md) and privileged execution context [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-x3hf-7cj6-3r4m.md) were the biggest amplifiers.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-x3hf-7cj6-3r4m.md
- E2: https://bugbountylibrary.com/r/h1%3A727727.md
- E3: https://bugbountylibrary.com/r/h1%3A696276.md