×
Ranked #1 for value density
First premium report free
LLM-optimized PDFs
How to Prevent Directory Traversal
Protect your files from unauthorized access.
Directory traversal (path traversal) allows attackers to read files outside the intended directory by using `../` sequences. This can expose sensitive files like passwords, configuration, and source code. This guide covers best practices to prevent directory traversal attacks.
150+
Security checks
16
Categories covered
30s
Scan duration
100%
Detection coverage
Key Findings
Path Traversal Vulnerability critical
What is Directory Traversal?
Directory traversal occurs when an application includes a file based on user input without proper validation. For example, `../../../../etc/passwd` can be used to read system files. This vulnerability can lead to full system compromise if sensitive files are exposed.
How to Prevent Directory Traversal
Follow these steps to prevent path traversal:
- 1. Never accept user input for file paths directly
- 2. Use `basename()` to extract only the filename
- 3. Use `realpath()` to resolve the full path and check if it stays within the intended directory
- 4. Store files outside the webroot
- 5. Map filenames to IDs (e.g., `file_id=1` → `file_1.pdf`)
- 6. Use a whitelist of allowed files or directories
Code Examples
Here are examples of how to safely include files:
- PHP: `$filename = basename($_GET["file"]); $path = __DIR__ . "/uploads/" . $filename; if (strpos(realpath($path), __DIR__ . "/uploads/") === 0) { include $path; }`
- Node.js: `const filename = path.basename(req.query.file); const filePath = path.join(__dirname, "uploads", filename); if (!filePath.startsWith(path.join(__dirname, "uploads"))) { return res.status(403).send("Forbidden"); }`
- Python: `filename = os.path.basename(request.args.get("file")); filepath = os.path.join(UPLOAD_DIR, filename); if not os.path.realpath(filepath).startswith(os.path.realpath(UPLOAD_DIR)): abort(403)`
The Problem
Directory traversal can expose sensitive files
- Using user input directly in file paths
- No input validation or sanitization
- Files stored in the webroot
- No whitelist of allowed files
OffURL Solution
OffURL detects directory traversal vulnerabilities and provides fix steps
- Test for path traversal vulnerabilities
- Check for exposed files
- Provide code examples to fix traversal issues
- Generate an LLM‑ready PDF for AI‑assisted fixes
Key Features
Traversal detection
We test for path traversal using multiple payloads.
Fix examples
Get ready‑to‑use code for your framework.
LLM‑ready PDF
Get a report formatted for ingestion into your AI assistant.
Actionable fixes
Receive specific recommendations for your stack.
How do I test if my site is vulnerable to directory traversal?
Run an OffURL audit. Our scanner sends multiple traversal payloads to common file parameters and checks for indicators of success. If vulnerable, you'll get detailed fix steps.
Frequently Asked Questions
What is OffURL and how does it work?
OffURL is a comprehensive website security and performance audit tool. It scans your site for 150+ checks including SSL, security headers, malware, XSS, SQL injection, email security, and more.
Is the security audit really free?
Yes. Your first security report is completely free and includes premium features like detailed findings, fix steps, and the full 150+ checks.
How can I use AI to fix security issues?
Download the premium PDF report and paste it into your preferred LLM (Claude, ChatGPT, Gemini, Cursor) with a prompt asking for specific fixes for your framework.
How long does the security audit take?
Most audits complete in 10‑30 seconds. The scan includes DNS lookups, SSL analysis, HTTP requests, port scanning, and vulnerability tests.
Do I need to create an account?
No. OffURL works without registration. Your first audit is free with premium features included.
What vulnerabilities can OffURL detect?
OffURL detects XSS, SQL Injection, NoSQL Injection, LDAP Injection, XXE, SSRF, SSTI, Code Injection, Command Injection, Open Redirect, Path Traversal, LFI, RFI, CRLF Injection, Parameter Pollution, and CORS Misconfiguration.