The fix, in one snippet
resolved = uploads.resolve() / safe_server_id
assert resolved.is_relative_to(uploads.resolve())Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
On a hostname the account has verified, Scan.now sends a fixed Unix and Windows traversal value to path-like GET parameters and looks only for known file signatures.
Why it matters
Traversal can disclose application source, credentials, keys and operating-system files.
How to fix it
Use server-generated file identifiers, resolve canonical paths and enforce that every resolved path remains below one non-executable storage directory.
Where this fits
Path traversal / local file inclusion is check 3 of 18 that the path traversal scanner runs under exposed files and information disclosure, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Exposed .git repository (critical), where the site's .git directory is reachable over HTTP. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Path traversal / local file inclusion closes one route in. Immediately below it: Exposed backup or archive files, where a backup archive, database dump or editor backup copy of a configuration file is downloadable from the web root, exposing source code, credentials and user data; Exposed phpinfo() page, where a phpinfo() page is publicly reachable; Directory listing enabled, where the web server generates an index of files for a directory that has no index page, exposing every file in it, including ones that are not linked from anywhere.
Found in the same scan
The path traversal scanner reports this alongside checks from other categories that are at least as serious, including SQL injection, where a GET parameter produced a repeatable database-error or boolean-response SQL injection indicator, and Server-side request forgery, where a URL-like parameter caused the verified server to request a unique Scan.now callback. A single run of path traversal scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Path traversal / local file inclusion (critical severity)
Scanner check id: path-traversal-activeThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
