Path Traversal in Vibe Coded Apps

What is path traversal?

Path traversal (also called directory traversal) is a vulnerability where attackers use ../ sequences to escape your intended directory and access files elsewhere on the server. When your code uses user input to construct file paths without validation, attackers can read sensitive files like /etc/passwd, configuration files, or your .env file containing API keys.

Think of it like an elevator that should only go to floors 1-10, but hackers trick it into going to the basement where secrets are stored by pressing "-1" repeatedly.

According to OWASP Top 10 (2021), path traversal falls under Broken Access Control, ranked #1. CWE-22 is in the CWE Top 25 Most Dangerous Software Weaknesses. The PortSwigger Path Traversal Guide provides detailed exploitation and prevention techniques. For vibe coders building file upload or download features, this is critical because AI tools generate vulnerable patterns by default.

How do AI tools cause path traversal?

AI tools generate path traversal vulnerabilities by creating simple, functional file handling code that concatenates user input directly into file paths. When you ask for a "file download endpoint" or "file upload feature," AI prioritizes working code over secure code.

// VULNERABLE: AI generates this for "download file" feature
app.get('/download', (req, res) => {
  const filename = req.query.file
  const filepath = `./uploads/${filename}` // DANGEROUS!
  res.sendFile(filepath)
})

// Attacker uses: /download?file=../../../etc/passwd
// Result: Server sends /etc/passwd to attacker

The false sense of security: Many vibe coders add path.resolve() thinking it prevents traversal. It doesn't. path.resolve() normalizes the path but doesn't restrict it. You must verify the result stays within your allowed directory.

Common vulnerable features in vibe coded apps include file downloads, image uploads, user avatar handling, document exports, and any endpoint that takes a filename parameter. Tools like Cursor, Bolt, and Claude Code can all generate these patterns.

What attack patterns do hackers use?

Attackers use various encoding and sequence techniques to bypass weak filters. Simply removing ../ from input is not sufficient.

According to PortSwigger, these bypass techniques are commonly successful because developers implement incomplete fixes.

What could happen if I have path traversal?

Path traversal can lead to sensitive file exposure, configuration theft, source code leaks, and in some cases remote code execution.

• Secrets exposure: Attackers read your .env file containing API keys, database credentials, and JWT secrets - see hardcoded secrets
• Configuration theft: Access to /etc/passwd, database configs, cloud credentials
• Source code leak: Reading your application code exposes business logic and other vulnerabilities
• Data destruction: If combined with write access, attackers can overwrite or delete files
• Code execution: Overwriting executable files or configs can lead to server compromise

How do I detect path traversal?

Search for file path construction that uses user input. Any code that builds paths from request parameters is potentially vulnerable.

// User input in file paths (DANGEROUS)
const filepath = `./uploads/${req.query.file}`
const filepath = path.join(uploadDir, filename)
const filepath = uploadDir + '/' + userInput

// File operations with user input (DANGEROUS)
res.sendFile(filepath)
fs.readFile(filepath)
fs.writeFile(filepath, data)
fs.createReadStream(filepath)

// path.resolve WITHOUT validation (STILL DANGEROUS)
const filepath = path.resolve('./uploads', filename)
res.sendFile(filepath) // No check if it's still in uploads!

// Regex to find vulnerable patterns:
// (sendFile|readFile|writeFile|createReadStream)\s*\([^)]*\$\{
// path\.(join|resolve)\s*\([^)]*req\.(query|params|body)

How do I fix path traversal?

Fix path traversal by validating that the resolved path stays within your allowed directory. Use path.resolve() to get the absolute path, then check it starts with your base directory.

// path.resolve alone is NOT enough!
const path = require('path')

app.get('/download', (req, res) => {
  const filename = req.query.file
  const filepath = path.resolve('./uploads', filename)
  res.sendFile(filepath) // STILL DANGEROUS!
})

// Attacker inputs: ../../../etc/passwd
// path.resolve returns: /etc/passwd
// File is served - attack succeeds!

// Validate resolved path stays in allowed directory
const path = require('path')
const UPLOADS_DIR = path.resolve('./uploads')

app.get('/download', (req, res) => {
  const filename = req.query.file
  const filepath = path.resolve(UPLOADS_DIR, filename)

  // CRITICAL: Check path is within uploads
  if (!filepath.startsWith(UPLOADS_DIR + path.sep)) {
    return res.status(403).send('Access denied')
  }

  res.sendFile(filepath)
})

// Attacker inputs: ../../../etc/passwd
// filepath resolves to: /etc/passwd
// Check fails: /etc/passwd doesn't start with /uploads/
// Returns 403 - attack blocked!

Frequently asked questions

Related content