Description

This script is vulnerable to directory traversal attacks.

Directory Traversal is a vulnerability which allows attackers to access restricted directories and read files outside of the web server's root directory.

Remediation

Your script should filter metacharacters from user input.

References

Acunetix Directory Traversal Attacks

Related Vulnerabilities

Ruby on Rails Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2016-0752)

SimpleHelp Path Traversal (CVE-2024-57727)

WordPress Plugin DM Albums Multiple File Deletion Vulnerabilities (2.1)

WordPress Plugin GD bbPress Attachments Multiple Vulnerabilities (2.2)

WordPress Plugin Cross-RSS Directory Traversal (1.7)

Severity

High

Classification

CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Directory Traversal