scan.now
Premium Scan a site

Scan for Path Traversal and Local File Inclusion

Enter a page on a hostname verified in your Scan.now account. Scan.now discovers path-like parameters in same-origin links and public GET forms, then reports only a recognised local-file signature returned by the server.

Verified ownership is required. A normal page URL works when it exposes file or download inputs; an exact parameterized endpoint remains optional.

A registered account is required to run this test. Finding status, evidence, affected locations and remediation are Premium-only. How active scanning works · Acceptable use

How path traversal escapes an intended file area

Download, template, image and document endpoints often turn a request value into a filesystem path. If the application joins that value to a directory without enforcing the final resolved location, parent-directory segments can escape the intended area and expose local files.

Because this check asks a server to resolve path-like input, Scan.now runs it only for an exact hostname verified in the account. A normal page URL is enough: the scanner discovers same-origin parameterised links and public GET forms, then tests recognised path inputs with bounded Linux and Windows traversal forms. A failure is recorded only when the response contains a known operating-system file signature; generic errors, status changes and echoed input do not count.

Put this result in context

This scanner answers one part of the review. Continue with Upload Surface Scanner for inventory public upload inputs without submitting a file, then Error Disclosure for detect exposed runtime exceptions and stack traces. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read Website Security: What a Vulnerability Scan Looks For and How to Fix It and What Is a Vulnerability Scan? Types, Limits and What the Results Mean. The Path traversal / local file inclusion check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

File-path inputs and local-file evidence

The check is deliberately bounded to the signals below.

Coverage areaWhat the scanner examines
Automatic path-input discoverySame-origin links and public GET forms are inspected for file, path, template, include, document, folder and download-style names.
Two platform familiesBounded traversal forms cover common Unix-like and Windows path handling without enumerating application files.
Content-confirmed evidenceA known local-file signature must be returned. A 200 response or an error message alone is not reported as traversal.

Local-file proof and bounded outcomes

A scan result is evidence with a boundary, not a guarantee about every route.

Local-file signature returned

Treat this as a critical containment failure. Preserve logs, restrict the endpoint and review what the application account can read.

No signature returned

The tested path-like parameters did not return the two known system-file signatures. Other encodings, operating systems and file APIs remain possible.

Ownership required

The scan will not send traversal probes until the exact hostname has a completed verification record in your account.

Canonical paths and enforced file boundaries

Use the recommendations below to address confirmed findings and strengthen the surrounding control.

  1. Use indirect file identifiers

    Map an opaque document ID to a server-side record instead of accepting a path from the request.

  2. Resolve and enforce containment

    Canonicalise the final path, then verify it remains beneath the one permitted root before opening it.

  3. Reject absolute and special paths

    Block absolute paths, drive letters, device names, NUL characters and parent segments before filesystem access.

  4. Run with least privilege

    The web process should not be able to read secrets, source repositories, private keys or unrelated customer files.

  5. Separate uploads from executable content

    Store user files outside the web root under generated names and serve them through a controlled download handler.

How it works

  1. Verify the hostname

    Add the exact site to your account and complete ownership verification before any path probe is allowed.

  2. Enter the relevant verified page

    A normal page URL works when it links to or displays the file-handling input. An exact endpoint remains optional when the feature is elsewhere.

  3. We require file-content proof

    A finding is created only when a fixed probe returns a recognised local operating-system file signature.

What this tool checks

1 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Exposed files and information disclosure

1 check

The ones that most often decide the grade:

Critical Path traversal / local file inclusionA path-like parameter returned a known local operating-system file signature.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Active Security File Upload Surface Scanner

Inventory public upload inputs without submitting a file
Active Security Error Disclosure Scanner

Detect exposed runtime exceptions and stack traces
Active Security SSRF Vulnerability Scanner

Correlate server-side URL fetching with a unique callback
Websites Website Vulnerability Scanner

Headers, TLS, cookies, exposed files

Guides for this tool

Background reading written to go with these results.

13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide
8 min read · Updated Sep 12, 2026 What Is a Vulnerability Scan? Types, Limits and What the Results Mean

A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...

Read the guide
8 min read · Updated Sep 14, 2026 Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate

Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...

Read the guide
9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide

Frequently asked questions

Why does this scanner require verified ownership?

Even a bounded path probe asks the application to access a local resource. Proof of control prevents this capability from being used casually against third-party sites.

Does blocking ../ fix path traversal?

Not reliably. Encodings, alternate separators and canonicalisation can recreate parent traversal after an early string check. Resolve the final path and enforce that it remains under the permitted root.

Why are generic error messages not treated as proof?

A rejected path, missing file or application error says nothing about whether filesystem boundaries were crossed. Scan.now requires a recognised file signature in the response.

Can object-storage keys have the same problem?

Yes. Although there is no operating-system directory, trusting a supplied object key can cross tenant or prefix boundaries. Use indirect identifiers and enforce ownership at the record layer.