notably affected versions 5.0 and earlier of Microsoft's IIS web server software. UTF-8 A badly implemented UTF-8 decoder may accept characters encoded using more bytes than necessary, leading to alternative character representations, such as %2e and %c0%ae both representing .. This is specifically forbidden by the UTF-8 standard, but has still led to directory traversal vulnerabilities in software such as the IIS web server. Archives Some archive formats like zip allow for directory traversal attacks: files in the archive can be written such that they overwrite files on the filesystem by backtracking. Code that extracts archive files can be written to check that the paths of the files in the archive do not engage in path traversal. Prevention A possible algorithm for preventing directory traversal would be to: Process URI requests that do not result in a file request, e.g., executing a hook into user code, before continuing below. When a URI request for a file/directory is to be made, build a full path to the file/directory if it exists, and normalize all characters (e.g., %20 converted to spaces). It is assumed that a 'Document Root' fully qualified, normalized, path is known, and this string has a length N. Assume that no files outside this directory can be served. Ensure that the first N characters of the fully qualified path to the requested file is exactly the same as the 'Document Root'. If so, allow the file to be returned. If not, return an error, since the request is clearly out of bounds from what the web-server should be allowed to serve. Using a hard-coded predefined file extension to suffix the path does not necessarily limit the scope of the attack to files of that file extension. <?php include($_GET['file'] . '.html'); The user can use the NULL character (indicating the end of the string) in order to bypass everything after the $_GET. (This is PHP-specific.) See also Chroot jails may be subject to directory traversal if incorrectly created. Possible directory traversal attack vectors are open file descriptors to directories outside the jail. The working directory is another possible attack vector. Insecure direct object reference References Resources Open Web Application Security Project The WASC Threat Classification – Path Traversal Path Traversal Vulnerability Exploitation and Remediation CWE Common Weakness Enumeration - Path Traversal External links DotDotPwn – The Directory Traversal Fuzzer – Conviction for using directory traversal. Bugtraq: IIS %c1%1c remote command