# Path traversal via normalization quirks

Path checks by substring, suffix-append, or partial alias match that a crafted name satisfies while escaping the directory

_Area: Web injection and code execution. Seen in 5 disclosed reports; one confirmed bounty: $1,500; latest 2026-09-02. Updated 2026-10-24._

## How it works
A path is judged safe by a check that does not constrain the final resolved path. The check looks for a substring, appends a suffix, or normalizes with one library while the filesystem or URL parser resolves with another. The assumption "the string contains the expected marker" or "the string ends with the safe suffix" equals "the file stays in the intended directory" is false. Delimiters, traversal sequences, or OS-specific separators move the real target outside the boundary while the check still passes.

## Where it shows up
- Extension or directory checks using substring/`strpos`/`contains` rather than suffix or resolved-path comparison [E1](https://bugbountylibrary.com/r/h1%3A458842.md)[E5](https://bugbountylibrary.com/r/h1%3A1626210.md)
- Security enforced only by appending a suffix to a name, with no containment check [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g29j-rwfv-h99w.md)
- URL/path parsing where `#` or `?` moves the appended suffix into a component the consumer discards [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g29j-rwfv-h99w.md)
- Mixed path libraries: one normalizes (posixpath), another resolves (ntpath on Windows), so `\..\` survives normalization [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2h4p-vjrc-8xpq.md)
- Server-side URL normalization that lets `..` reach a protected endpoint [E4](https://bugbountylibrary.com/r/h1%3A694865.md)

## How to review
State the invariant: the fully resolved, canonical path must remain inside the intended base directory, and the extension must be the true final suffix. Check that the code resolves and canonicalizes (realpath, normalize, decode) with the same library the filesystem uses, then compares whole path components, not substrings. For suffix-appended names, confirm the suffix cannot land in a discarded URL component. For cross-platform code, enumerate the separator and alias space of the resolving OS. Confirm any containment helper is actually called, not just present in sibling code.

## Variants seen
- Substring extension check bypassed by embedding `.HL1` mid-path [E1](https://bugbountylibrary.com/r/h1%3A458842.md)
- Appended `.hbs` suffix pushed into URL fragment by trailing `#` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g29j-rwfv-h99w.md)
- posixpath normalization vs ntpath resolution lets backslash traversal pass [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2h4p-vjrc-8xpq.md)
- URL normalization traversal `/+CSCOU+/../+CSCOE+/` reaching protected endpoint [E4](https://bugbountylibrary.com/r/h1%3A694865.md)
- `strpos` containment check satisfied while `../` escapes directory [E5](https://bugbountylibrary.com/r/h1%3A1626210.md)

## Why fixes fail
E3 shows a partial fix: blocking one literal alias while other separators and structural bytes pass. E5 shows a prior report fixed one path but the substring check remained bypassable. E2 shows a loader missing the containment helper its siblings use, leaving the suffix as the sole boundary.

## Impact and severity
Arbitrary file read (source, credentials, session data) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g29j-rwfv-h99w.md)[E4](https://bugbountylibrary.com/r/h1%3A694865.md)[E5](https://bugbountylibrary.com/r/h1%3A1626210.md) and arbitrary file write enabling DLL loading [E1](https://bugbountylibrary.com/r/h1%3A458842.md). Severity is high where unauthenticated and where the check is the sole boundary with no containment helper [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g29j-rwfv-h99w.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A458842.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-g29j-rwfv-h99w.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-2h4p-vjrc-8xpq.md
- E4: https://bugbountylibrary.com/r/h1%3A694865.md
- E5: https://bugbountylibrary.com/r/h1%3A1626210.md