Simple web based file browser with Flask
@Matthias has already mentioned this in the comments, and he is correct.

The code suffers from a Directory Traversal vulnerability

You can filter this in 2 ways:


Use os.path.realpath and check if the resolved path is different

def check_lfi(file_path):
    return os.path.realpath(file_path) != file_path

Use regex to filter out bad (../) Paths

import re
DIR_TRAVERSAL = re.compile(r"\.\.\/")
def check_lfi(file_path):
    return bool(DIR_TRAVERSAL.search(file_path))



My advice would be to use the first example, since blacklisting can be error prone (Unicode for instance)