Is it possible to perform path traversal by setting the filename of an uploaded path to include a path? Does Windows/Linux/any other operating system allow such filenames?

For example, naming a file "../test.txt" (if it's possible at all) and uploading it to a website. If the website does not validate the filename, it could save the file to the parent directory instead (assuming folder permissions allow this).


You wouldn't be able to name a file ../test.txt as no filesystem (that I'm aware of) allows forward slashes within the filename. (Certainly all POSIX filesystems do not.)

That being said, for an attacker, it doesn't matter. The filename is sent as part of the HTTP POST data, which is of course subject to tampering by an attacker:

Content-Disposition: form-data; name="formfield"; filename="file.txt"
Content-Type: text/plain


So an attacker can easily specify something other than "file.txt" for the filename field. Whether your application server or application code will accept a filename containing is what will determine if you are vulnerable to a directory traversal via the filename.

  • the name of the file does not need to be valid as a mere filename, if the file's form input's name field is naively fed to some low-level command that expects a name or path.
    – dandavis
    Jan 11 '18 at 9:21

yes it is possible, in any linux machine you can name any file anything you want including special characters!

In hackerone there is a ctf that includes path traversal in file upload.

  • No. To do a directory traversal, you need to include a directory separator in the file name, and that's the one character (that and the null byte) which is forbidden in Linux file names. Please read David's answer which explains this very well. Aug 6 '19 at 15:21
  • and you should try the hacker101 ctf tempimage that you need to set up the file name to ../file.txt to get one flag. Aug 7 '19 at 11:22
  • There are also automated tools to test this specific vulnerability in file uploads.. github.com/PortSwigger/file-upload-traverser Aug 7 '19 at 11:25
  • That's precisely why this vulnerability arises. On Linux, you cannot put a slash in a file name: it's a directory separator. So if you put a slash as a file name in an application, for example via a web form, the application ends up accessing a file in a different directory from what was intended. Aug 7 '19 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.