# Path traversal via unvalidated identifier

User-controlled id, slug, filename or config value joined into a path without canonical containment

_Area: Web injection and code execution. Seen in 3 disclosed reports; 2 confirmed bounties: $4,134 and $5,000; latest 2026-06-14. Updated 2026-11-03._

## How it works
A value the user controls (an id, slug, filename, extension, or config key) is concatenated or resolved into a path — a filesystem path or a URL path — and the code assumes the value is a harmless single segment. If the value can contain `../`, absolute prefixes, or separators, the resolved path escapes the intended directory or endpoint and lands on a sibling the developer never meant to expose. The broken assumption is "this identifier is just a name"; nothing enforces that the final resolved path stays inside the intended base.

## Where it shows up
- IDs interpolated into URL paths, e.g. an embed URL built from a `videoid` [E1](https://bugbountylibrary.com/r/blog%3Alyra-horse-blog-2024-09-using-youtube-to-steal-your-files.md).
- Filenames or extensions derived from remote page metadata (file-input `accept`, filename) then passed to `Path.resolve()` [E2](https://bugbountylibrary.com/r/h1%3A3712279.md).
- URL path normalization gaps in appliance web servers, e.g. `/+CSCOU+/../+CSCOE+/` [E3](https://bugbountylibrary.com/r/h1%3A694865.md).
- Any `join`/`resolve`/string-concat of user input with a base directory or route.

## How to review
Find every place user input reaches a path. The invariant: after resolution, the canonical path must still be inside the intended base directory, and a built URL must stay on the intended host and path prefix. Check that the code canonicalizes (realpath/`Path.resolve`) and then verifies containment, rather than only stripping `../` or trusting a regex. For URL builders, confirm the identifier cannot introduce `/` or `..` that change the host or route.

## How finders spotted it
- Noticed Slides built an embed URL from a user-controlled `videoid` and tried `../` to reach sibling endpoints; then hunted framable paths and open redirects in auth flows [E1](https://bugbountylibrary.com/r/blog%3Alyra-horse-blog-2024-09-using-youtube-to-steal-your-files.md).
- Decompiled the target and traced `prepareFileInput -> buildTemporaryUploadFile -> deriveFileNameFromFileInput`, spotting `accept` tokens appended as extensions and passed to `Path.resolve` unsanitized [E2](https://bugbountylibrary.com/r/h1%3A3712279.md).
- Known-CVE sweep: scanned a large IP range for the CVE-2018-0296 signature, fingerprinted the ASA login page, found an unpatched instance still accepting password auth instead of cert auth, then tested the `/+CSCOU+/../+CSCOE+/files/file_list.json` traversal with `--path-as-is` to bypass client-side normalization [E3](https://bugbountylibrary.com/r/h1%3A694865.md).

## Variants seen
- Traversal in a URL path to reach sibling endpoints, chained with open redirects [E1](https://bugbountylibrary.com/r/blog%3Alyra-horse-blog-2024-09-using-youtube-to-steal-your-files.md).
- Filename/extension derived from remote metadata written to a local path [E2](https://bugbountylibrary.com/r/h1%3A3712279.md).
- Appliance URL normalization flaw reachable unauthenticated (known CVE) [E3](https://bugbountylibrary.com/r/h1%3A694865.md).

## Impact and severity
Ranged from unauthenticated file listing and VPN session data disclosure [E3](https://bugbountylibrary.com/r/h1%3A694865.md), to persistence via Startup-folder write with delayed execution [E2](https://bugbountylibrary.com/r/h1%3A3712279.md), to a one-click clickjack of a Drive share dialog granting editor access [E1](https://bugbountylibrary.com/r/blog%3Alyra-horse-blog-2024-09-using-youtube-to-steal-your-files.md). Impact rose when chained with open redirects and same-origin redirects bypassing Sec-Fetch-Site [E1](https://bugbountylibrary.com/r/blog%3Alyra-horse-blog-2024-09-using-youtube-to-steal-your-files.md), and when the write landed in an auto-run location [E2](https://bugbountylibrary.com/r/h1%3A3712279.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alyra-horse-blog-2024-09-using-youtube-to-steal-your-files.md
- E2: https://bugbountylibrary.com/r/h1%3A3712279.md
- E3: https://bugbountylibrary.com/r/h1%3A694865.md