{"id":53418,"date":"2014-08-04T12:28:52","date_gmt":"2014-08-04T12:28:52","guid":{"rendered":"https:\/\/www.checkmarx.com\/?post_type=glossary&p=8883"},"modified":"2024-06-21T14:05:29","modified_gmt":"2024-06-21T14:05:29","slug":"directory-traversal-vulnerability","status":"publish","type":"glossary","link":"https:\/\/checkmarx.com\/glossary\/directory-traversal-vulnerability\/","title":{"rendered":"Directory Traversal Vulnerability"},"content":{"rendered":"

Directory Traversal Defined<\/b>
\nDirectory Traversal (DT) is a HTTP exploit that malicious hackers use in order to gain access to account directories and the data contained within. A successful exploit can result in the entire web server being compromised, including access to directories that are used to control access to restricted areas. For example, the Root Directory is the top-level directory on the server’s file system. Directory Traversal can be used to gain unauthorized access to this sensitive directory. However, Access Control Lists (ACLs) can be used to control and manage user access for viewing, modifying and executing files.
\n<\/span>
\nThis vulnerability occurs when browser input is not properly validated, thus allowing malicious attackers to gain access to privileged areas. The Directory Traversal vulnerability can be found in multiple coding languages including Perl, PHP, Apache, Python, ColdFusion and others.<\/p>\n

How the DT exploit works<\/b>
\nThere are two main types of DT vulnerabilities – web server vulnerabilities and application code vulnerabilities.<\/p>\n