A webapp has an img tag that partially takes userinput like so:

<img src="/blah/blah/$USERINPUT.jpg">

where the first / is from the root of the domain.

Could there be a vulnerability here? Potentially using ../ and then attempting path traversal?

  • 2
    Since your browser loads the image, SSRF isn't possible. You want their server to load it Commented Sep 28, 2020 at 1:35
  • If i were you I'll test that for XSS Commented Jun 26, 2021 at 14:49

2 Answers 2


Few conflicting things here.

SSRF is where you make the server request a (usually foreign) URL on your behalf. It is not the exact same as path traversal. Path traversal might be possible but I would be surprised -- a better indicator of path traversal would be a filename inside of the query portion of a URL, or inside POST data.

Your best bet for finding an issue for reflected user input is usually cross-site scripting. If you modify the user input, are quotes escaped?


Unless you are leaving out information about some kind of server-side renderer, you aren't going to find an SSRF here. An SSRF causes the server to fetch content; changing an image tag only affects the HTML, and HTML is just going to be rendered on the client.

If you are testing for path traversal, there's no need to try to do it through an image tag. Simply request a page with ../../ in the path. However, I too would be surprised if this works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .