Path Traversal Risk Calculator

Rate directory traversal risk from how file paths are built and canonicalised, and what the process can read or overwrite.

About Path Traversal Risk Calculator

Any check performed before canonicalisation can be defeated, so decoding once and comparing strings scores 6 while resolving the real path and testing the prefix scores 1. Impact turns on confinement: the same traversal is an application-file read in a locked container and a private-key theft on a host filesystem. Traversal that reaches a write is an RCE in disguise — overwrite a cron file, a template or a startup script and the read-only bug becomes code execution.

Formula

Path Traversal Risk

Likelihood = mean(path construction, canonicalisation, encoding handling); impact = mean(filesystem confinement, reachable secrets, write access).

canonical: 1 real path resolved and prefix-checked … 9 no checking
writeAccess: 3 read-only … 9 same handler writes

Worked example

With the default values below, Path Traversal Risk Calculator returns Overall Risk Severity of Critical. Change any input above and every figure here is recalculated in your browser.

Inputs used

How the file path is builtone of Opaque ID mapped to a server-side path — 1, Allow-listed filename from a fixed set — 2, User filename with a prefix check — 5, User input concatenated onto a base path — 9: User input concatenated onto a base path — 9
Canonicalisation before the checkone of Real path resolved, then prefix-checked — 1, Single decode then string comparison — 6, Deny-list of traversal sequences — 8, No checking — 9: Deny-list of traversal sequences — 8
Encoding handlingone of Encoded separators and zero bytes rejected — 2, Decoded exactly once — 6, Decoded repeatedly until stable — 9: Decoded exactly once — 6
Filesystem confinementone of Object storage, no local filesystem — 1, chroot or read-only container mounts — 3, A dedicated data directory — 6, Process can read from the filesystem root — 9: A dedicated data directory — 6
Sensitive files readable by the processone of Application assets only — 3, Configuration files — 6, Private keys and credentials — 8, Everything readable by root — 9: Private keys and credentials — 8
Write or delete on the same handlerone of Read-only — 3, Writes go to a separate directory — 6, Writes use the same path handler — 9: Writes go to a separate directory — 6

Results

Overall Risk Severity: Critical
Likelihood Score: 7.67 / 9
Impact Score: 6.67 / 9
Risk Score: 5.68 / 9
Escalation Path: Read primitive — private keys and credentials are exposed
Highest-Value Fix: Map an opaque identifier to a server-side path instead of taking a filename

Step by step

1Values used
2Path Traversal Risk
3Overall Risk Severity= Critical
4Likelihood Score= 7.67 / 9
5Impact Score= 6.67 / 9
6Risk Score= 5.68 / 9
7Escalation Path= Read primitive — private keys and credentials are exposed
8Highest-Value Fix= Map an opaque identifier to a server-side path instead of taking a filename

Assumptions and limits

The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Path Traversal Risk calculated?

Likelihood = mean(path construction, canonicalisation, encoding handling); impact = mean(filesystem confinement, reachable secrets, write access). Any check performed before canonicalisation can be defeated, so decoding once and comparing strings scores 6 while resolving the real path and testing the prefix scores 1. Impact turns on confinement: the same traversal is an application-file read in a locked container and a private-key theft on a host filesystem.

Why does Path Traversal Risk matter?

Traversal that reaches a write is an RCE in disguise — overwrite a cron file, a template or a startup script and the read-only bug becomes code execution.

What values do I need to enter?

This calculator takes 6 inputs: How the file path is built, Canonicalisation before the check, Encoding handling, Filesystem confinement, Sensitive files readable by the process, Write or delete on the same handler. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is stripping '../' the wrong defence?

Because the encodings outnumber the filter: %2e%2e%2f, double-encoded forms, UTF-8 overlongs, backslashes on Windows, absolute paths and symlinks all bypass a sequence-stripping filter, and stripping can even create a traversal from an innocent string. Resolve the path, then verify it is inside the base directory.