Can path traversal vulnerabilities occur in REST style URLs?

For example: https://x.com/filename/img.jpeg


Does this make sense ?

  • Is there a path behind the REST calls?
    – schroeder
    Jun 4, 2022 at 20:56

1 Answer 1


There is no such thing as "REST style URLs". All URLs are just URLs. If you wanted to ask if REST services are vulnerable to path traversal attacks, here is the answer.

It depends on the implementation. In Java based frameworks like Apache CXF, Jersey, RESTeasy, Spring Boot etc. and in ASP.NET it is not possible, because first they search for code that corresponds to the URL. If no such code found, the return an error, often HTTP 404.

But if you implement REST service with scripts in a CGI manner and if you map URLs to file system paths, then yes, such implementation can be vulnerable to path traversal attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .