# Path traversal via unsanitized path join

User input joined into a file path without decode, canonicalize, and root confinement

_Area: Web injection and code execution. Seen in 28 disclosed reports; 15 confirmed bounties, median $5,000, range $250-$20,000; latest 2026-10-08. Updated 2026-10-23._

## How it works
Code builds a path by joining a trusted base (directory, repo root, temp dir, URL prefix) with a value the user controls: a filename, org/username, revision, or page metadata. The broken assumption is that the user value is a single harmless segment. If it carries `../`, `..\`, an encoded form (`%2e%2e%2f`), or an absolute path, the join resolves outside the base. Nothing compares the final resolved path to the intended root, so reads and writes land wherever the attacker points. Adjacent sink: a local filename taken from a URL substring, ignoring fragment/query, so the fragment overrides the filename [E3](https://bugbountylibrary.com/r/blog%3Abalintmagyar-com-articles-google-web-designer-path-traversal-client-side-rce-cve-2025-4613.md).

## Where it shows up
- Regex captures a path segment later passed to a storage/uploader API such as `retrieve_from_store!` [E2](https://bugbountylibrary.com/r/h1%3A827052.md).
- Usernames or coordinates joined into a repository/registry root [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-fixed-rce-gogs-cve-2026-52813.md).
- Local filename derived from the last URL segment, ignoring fragment/query (adjacent URL-parsing sink) [E3](https://bugbountylibrary.com/r/blog%3Abalintmagyar-com-articles-google-web-designer-path-traversal-client-side-rce-cve-2025-4613.md).
- Page-controlled metadata (file-input `accept`, filenames) used to synthesize local files [E5](https://bugbountylibrary.com/r/h1%3A3712279.md).
- Request parameter concatenated onto a temp-dir root [E7](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bo.md)[E8](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gladinet-centrestack-triofox-local-file-inclusion-flaw.md).
- A revision parameter concatenated into a filesystem path, crossing tenant boundaries [E4](https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2018-12-03-hijack-the-js-file-of-uber-s-website.md).
- File handlers passing user filenames straight to `getFile()` or an upload sink [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-77xj-x4rm-935c.md).

## How to review
Find every user-influenced string reaching a file open/write/upload call (`getFile`, uploader, `retrieve_from_store!`) or a URL-derived filename. Invariant: decode first, then canonicalize (realpath, `Path.resolve`, `os.path.commonpath`), and the resolved result must remain inside the intended root. Ordering matters: decode before canonicalizing, and repeat until stable, so double-encoded `%252e%252e%252f` cannot slip through (reviewer guidance; no evidence tests double-encoding). `Path.resolve()` alone normalizes but does not confine [E5](https://bugbountylibrary.com/r/h1%3A3712279.md). Reject absolute paths; handle Windows `..\` and drive letters (reviewer guidance; no evidence tests these). Prefix-string checks fail on sibling directories (`/base` vs `/base-evil`); compare canonical paths. If one handler was patched, audit siblings in the same command map (WRITE, RENAME, REMOVE, CREATE) [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-77xj-x4rm-935c.md). For registries, sanitize metadata before filename construction [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-fixed-rce-gogs-cve-2026-52813.md).

## Variants seen
- Traversal via org username writing a bare repo; hook hijack is a second stage, not the traversal itself [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-fixed-rce-gogs-cve-2026-52813.md).
- Traversal through a regex-captured upload reference during issue copy [E2](https://bugbountylibrary.com/r/h1%3A827052.md).
- Traversal in a URL-derived download filename, leading to native library load [E3](https://bugbountylibrary.com/r/blog%3Abalintmagyar-com-articles-google-web-designer-path-traversal-client-side-rce-cve-2025-4613.md).
- Traversal in a multi-tenant template revision path, overwriting another account's JS [E4](https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2018-12-03-hijack-the-js-file-of-uber-s-website.md).
- Traversal in file handlers lacking canonicalization, reaching RCE [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-77xj-x4rm-935c.md).
- Traversal in a security tool's temp-file handling from page metadata [E5](https://bugbountylibrary.com/r/h1%3A3712279.md).
- Traversal in a temp-dir concatenation leaking files, chained to config-write RCE [E7](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bo.md).
- Same temp-dir concatenation re-exposed on a patched appliance via an unauthenticated file-read primitive [E8](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gladinet-centrestack-triofox-local-file-inclusion-flaw.md).

## Why fixes fail
Patching one operator while leaving siblings unguarded [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-77xj-x4rm-935c.md); rotating secrets without closing the file-read primitive that re-leaks them [E7](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bo.md)[E8](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gladinet-centrestack-triofox-local-file-inclusion-flaw.md); relying on `Path.resolve()` or prefix-string checks that normalize or match siblings without confining [E5](https://bugbountylibrary.com/r/h1%3A3712279.md).

## Impact and severity
Arbitrary file read and arbitrary file write, often escalating to RCE [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-fixed-rce-gogs-cve-2026-52813.md)[E3](https://bugbountylibrary.com/r/blog%3Abalintmagyar-com-articles-google-web-designer-path-traversal-client-side-rce-cve-2025-4613.md)[E5](https://bugbountylibrary.com/r/h1%3A3712279.md)[E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-77xj-x4rm-935c.md)[E7](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bo.md)[E8](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gladinet-centrestack-triofox-local-file-inclusion-flaw.md). Read-only traversal leaks credentials and keys [E7](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bo.md)[E8](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gladinet-centrestack-triofox-local-file-inclusion-flaw.md); write traversal plants code or hijacks hooks [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-fixed-rce-gogs-cve-2026-52813.md)[E3](https://bugbountylibrary.com/r/blog%3Abalintmagyar-com-articles-google-web-designer-path-traversal-client-side-rce-cve-2025-4613.md)[E5](https://bugbountylibrary.com/r/h1%3A3712279.md). Severity rises when no authentication is required [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-77xj-x4rm-935c.md)[E7](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bo.md)[E8](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gladinet-centrestack-triofox-local-file-inclusion-flaw.md). Authenticated traversal [E2](https://bugbountylibrary.com/r/h1%3A827052.md)[E4](https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2018-12-03-hijack-the-js-file-of-uber-s-website.md) is still critical when it crosses tenant boundaries or chains to code execution.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-fixed-rce-gogs-cve-2026-52813.md
- E2: https://bugbountylibrary.com/r/h1%3A827052.md
- E3: https://bugbountylibrary.com/r/blog%3Abalintmagyar-com-articles-google-web-designer-path-traversal-client-side-rce-cve-2025-4613.md
- E4: https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2018-12-03-hijack-the-js-file-of-uber-s-website.md
- E5: https://bugbountylibrary.com/r/h1%3A3712279.md
- E6: https://bugbountylibrary.com/r/ghsa%3AGHSA-77xj-x4rm-935c.md
- E7: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bo.md
- E8: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gladinet-centrestack-triofox-local-file-inclusion-flaw.md