Request To File Access

Vulnerable vs. safe

var text = File.ReadAllText("/data/" + name);

var text = File.ReadAllText(Path.Combine("/data", safe));

Why it matters & how to fix it

Untrusted request input flows into a filesystem path, enabling path traversal (CWE-22) that can read or overwrite files outside the intended directory via '../' sequences. Do not pass user input to Path.Combine or File APIs directly: map to a safe identifier, then canonicalize with Path.GetFullPath and verify the result stays under an allowed base directory.

References

• https://owasp.org/www-community/attacks/Path_Traversal
• https://cwe.mitre.org/data/definitions/22.html

Related checks

• JavaScript / TypeScript - SSRF & Path Traversal
  Path Join With Request
• JavaScript / TypeScript - SSRF & Path Traversal
  Path Traversal Tainted Input
• JavaScript / TypeScript - SSRF & Path Traversal
  SSRF Outbound Request Tainted Input
• Python - SSRF & Path Traversal
  Path Traversal
• Python - SSRF & Path Traversal
  SSRF HTTP Request
• Java - SSRF & Path Traversal
  Path Traversal Tainted Input