Is it possible to perform path traversal by setting the filename of an uploaded path to include a path? Does Windows/Linux/any other operating system allow such filenames?

For example, naming a file "../test.txt" (if it's possible at all) and uploading it to a website. If the website does not validate the filename, it could save the file to the parent directory instead (assuming folder permissions allow this).

3 Answers 3


You wouldn't be able to name a file ../test.txt as no filesystem (that I'm aware of) allows forward slashes within the filename. (Certainly all POSIX filesystems do not.)

That being said, for an attacker, it doesn't matter. The filename is sent as part of the HTTP POST data, which is of course subject to tampering by an attacker:

Content-Disposition: form-data; name="formfield"; filename="file.txt"
Content-Type: text/plain


So an attacker can easily specify something other than "file.txt" for the filename field. Whether your application server or application code will accept a filename containing is what will determine if you are vulnerable to a directory traversal via the filename.

  • the name of the file does not need to be valid as a mere filename, if the file's form input's name field is naively fed to some low-level command that expects a name or path.
    – dandavis
    Jan 11, 2018 at 9:21

The file name ../file.txt is not possible, but as the topic is path traversal via file name there is another technique to do that.

If you are using cURL then it's possible:

curl Your-URL -F "[email protected];filename=../../key.txt"

Here the first #filename is local file name and the second #filename is a HTTP request. This is a quick way to test path traversal in a file upload functionality.


yes it is possible, in any linux machine you can name any file anything you want including special characters!

In hackerone there is a ctf that includes path traversal in file upload.

  • No. To do a directory traversal, you need to include a directory separator in the file name, and that's the one character (that and the null byte) which is forbidden in Linux file names. Please read David's answer which explains this very well. Aug 6, 2019 at 15:21
  • and you should try the hacker101 ctf tempimage that you need to set up the file name to ../file.txt to get one flag. Aug 7, 2019 at 11:22
  • There are also automated tools to test this specific vulnerability in file uploads.. github.com/PortSwigger/file-upload-traverser Aug 7, 2019 at 11:25
  • That's precisely why this vulnerability arises. On Linux, you cannot put a slash in a file name: it's a directory separator. So if you put a slash as a file name in an application, for example via a web form, the application ends up accessing a file in a different directory from what was intended. Aug 7, 2019 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .