How a harmless-looking <code>filename</code> parameter can become server-side file access, and why the real issue is trusting user input as a path.
After CSRF and SameSite cookies, I moved to a vulnerability that looked simple at first: Path Traversal.
At first, I thought about it as “someone puts <code>../</code> in a URL and reads <code>/etc/passwd</code>.” Technically, yes. That can happen. But that explanation is too small.
The useful model is this:
<blockquote>
User input influences a server-side file path, and the backend reads a file it should not expose.
</blockquote>
The attacker is not browsing the server like they have a shell. They are making the application read a file for them.
And honestly, this topic changed how I look at boring parameters like <code>filename=4.jpg</code>.
<h2>The innocent image request</h2>
A common vulnerable pattern starts with something completely normal:
<pre><code>GET /image?filename=4.jpg
</code></pre>
The backend may do something like this:
<pre><code>app.get(&quot;/image&quot;, (req, res) =&gt; {
 res.sendFile(&quot;/var/www/images/&quot; + req.query.filename);
});
</code></pre>
From a frontend perspective, this looks harmless. We are loading an image. The parameter is called <code>filename</code>. The value ends with <code>.jpg</code>.
Nothing screams “security issue”.
But the backend is building a filesystem path from user-controlled input.
If the user sends:
<pre><code>GET /image?filename=../../../etc/passwd
</code></pre>
The final path may escape the intended image directory and resolve to:
<pre><code>/etc/passwd
</code></pre>
That is the mental model:
<pre><code>request parameter -&gt; backend file logic -&gt; filesystem -&gt; response
</code></pre>
The interesting part is not the strange-looking payload. The interesting part is that user input reached the filesystem logic.
<h2>File name and file path are not the same thing</h2>
<img src="https://media.daily.dev/image/upload/s--XtzDQZ1F--/f_auto/v1781809723/ugc/content_d385c41d-f559-401e-9c60-52889af235e8?_a=BAMAMiWQ0" alt="4a808af6-ac03-49ed-8244-77f31ab26b2a.png">
This distinction helped me a lot.
A file name is just the name:
<pre><code>avatar.jpg
invoice.pdf
</code></pre>
A file path describes where the file lives:
<pre><code>/var/www/images/avatar.jpg
../../config.php
/etc/passwd
</code></pre>
A safer design avoids raw paths from users.
Instead of this:
<pre><code>GET /download?file=../../private/report.pdf
</code></pre>
Use a safe identifier:
<pre><code>GET /download?id=report_123
</code></pre>
Then the server maps that ID to a known file and checks whether the user is allowed to access it:
<pre><code>report_123 -&gt; /app/private/reports/report-123.pdf
</code></pre>
The user controls the choice, not the filesystem path.
That difference sounds small, but it is massive. One model exposes the filesystem shape to user input. The other keeps file selection inside application logic.
<h2>Why <code>../</code> works</h2>
<code>../</code> means “go one directory up”.
So this:
<pre><code>/var/www/images/../
</code></pre>
resolves to:
<pre><code>/var/www/
</code></pre>
And this:
<pre><code>/var/www/images/../../../etc/passwd
</code></pre>
can resolve to:
<pre><code>/etc/passwd
</code></pre>
The raw string may still contain <code>/var/www/images/</code>, but the final resolved path points somewhere else.
That is why security checks must validate the resolved path, not only the original input string.
<h2>The first lab: simple traversal</h2>
The first practical case used an image-loading endpoint:
<pre><code>GET /image?filename=4.jpg
</code></pre>
Changing the filename to a random value returned:
<pre><code>No such file
</code></pre>
That response was useful. It suggested the value was being used in file access logic.
Then the traversal payload worked:
<pre><code>GET /image?filename=../../../etc/passwd
</code></pre>
My first reaction was not even “wow, I can read <code>/etc/passwd</code>”. It was more like: why are the basic labs this easy? Change one parameter, add a few <code>../</code> sequences, and the server gives back a system file.
Later, I realised that was the point.
The lab was simple because the vulnerable trust decision was simple:
<pre><code>user-controlled filename = safe file path
</code></pre>
That was the actual bug.
The server did not need a complex exploit chain. It only needed to accept user input and pass it into file access without checking where the final path ended up.
That is also why beginner labs can feel weirdly easy. They are stripped down to expose one broken assumption. Real applications may add routing, encoding, framework behaviour, authentication, and messy business logic around it. But the core mistake can still be painfully simple.
<h2>Errors are clues</h2>
The <code>No such file</code> message was useful because it told me something about the backend.
Different errors point toward different places:
<pre><code>No such file -&gt; filesystem access
SQL syntax error -&gt; database query
Template error -&gt; template rendering
Invalid include -&gt; file include logic
</code></pre>
That does not mean every error is exploitable. But errors can reveal which subsystem received your input.
This is one of the practical things I am learning in AppSec: do not only ask whether a payload worked. Ask how the application reacted.
A boring error can be a map.
<h2>Where I would actually test</h2>
<img src="https://media.daily.dev/image/upload/s--Zn0IL0oL--/f_auto/v1781809826/ugc/content_6a878591-0a21-4a65-b19d-84e4b26da9cd?_a=BAMAMiWQ0" alt="ca2866d3-5000-4523-849e-4380fa2df7fb.png">
Not every input is worth testing for Path Traversal.
A normal search request usually goes to search logic:
<pre><code>GET /search?q=test
</code></pre>
Path Traversal testing makes more sense around parameters and features that suggest file access:
<pre><code>file
filename
path
page
lang
template
view
document
download
image
avatar
attachment
export
</code></pre>
I also pay attention to features such as:
<ul>
<li>image loaders;</li>
<li>file downloads;</li>
<li>PDF previews;</li>
<li>attachments;</li>
<li>language files;</li>
<li>templates;</li>
<li>exports and reports.</li>
</ul>
The practical question is always:
<blockquote>
Can user input influence which file the backend reads, loads, streams, or includes?
</blockquote>
That question is more useful than blindly throwing <code>../../../etc/passwd</code> into every input field.
<h2>Path Traversal is a trust-boundary problem</h2>
<img src="https://media.daily.dev/image/upload/s--G_E5hhmW--/f_auto/v1781809843/ugc/content_b923d43f-79d9-4a64-a0f0-7510cea33afb?_a=BAMAMiWQ0" alt="3117b619-3694-47c9-88e6-b1962c1c0d32.png">
From a frontend point of view, <code>filename=4.jpg</code> may look like harmless UI plumbing.
From a backend security point of view, it can be a trust-boundary crossing:
<pre><code>Browser input -&gt; server filesystem
</code></pre>
The browser should not be allowed to decide raw filesystem paths. It can request a resource, but the server should decide what that request maps to.
A safer flow looks like this:
<pre><code>User selects report
 ↓
Frontend sends report ID
 ↓
Backend checks ownership/permission
 ↓
Backend maps ID to stored file path
 ↓
Backend streams the file
</code></pre>
The dangerous flow is:
<pre><code>User sends path
 ↓
Backend reads that path
</code></pre>
That shortcut is where Path Traversal lives.
<h2>Summary</h2>
Path Traversal is not about manually browsing folders on the server.
It is about making the application read a file on your behalf.
The bug appears when user-controlled input influences file access and the backend fails to validate the final resolved path. The payload may look like the exciting part, but the real issue is the trust decision behind it.
In Part 2, I will go into the bypasses that made this topic more interesting: absolute paths, weak filtering, double URL encoding, prefix checks, LFI/RFI, and safer Node.js path validation.
<h2>My takeaway</h2>
Before this topic, I looked at parameters like <code>filename=4.jpg</code> as boring plumbing.
Now I see them as questions.
Where does this value go? Does it touch the filesystem? Is it a safe key or a raw path? What happens after decoding? What is the final resolved file?
That shift is probably the biggest thing I am getting from AppSec as a frontend engineer: the dangerous part is often not the weird payload. It is the ordinary parameter that quietly crosses a trust boundary.
I’m also testing a more relaxed visual style for this series. Do you like the direction? Let me know in the comments!

Przemyslaw

Path Traversal vulnerabilities occur when user-controlled input influences server-side file paths without proper validation of the resolved path. Using a simple image-loading endpoint as an example, the core issue is that parameters like `filename=4.jpg` can be manipulated with `../` sequences to escape the intended directory and access arbitrary files like `/etc/passwd`. The safer design pattern avoids exposing filesystem paths to users entirely — instead, accepting opaque IDs that the server maps to actual file paths internally. Error messages can serve as clues about which backend subsystem processed the input. Key parameters to watch include: file, filename, path, page, lang, template, view, and download. Part 2 will cover bypasses including absolute paths, weak filtering, double URL encoding, and LFI/RFI.

Key Web Vulnerabilities #6, Part 1: Path Traversal Is Not About Browsing Folders