Directory Path Traversal

Accesses arbitrary restricted files outside web root directory via ../ sequence manipulation.

Core Principles & Analysis

• Among the oldest documented web flaws, dating to the 1990s.
• Exposes configuration files, credentials, and application source code.
• Prevented by canonicalizing paths and rejecting traversal sequences.

Specifications & Metrics

• CVE: CWE-22
• IMPACT: High