Path Traversal Risk Calculator

Rate directory traversal risk from how file paths are built and canonicalised, and what the process can read or overwrite.

Inputs

How the file path is built

Canonicalisation before the check

Encoding handling

Filesystem confinement

Sensitive files readable by the process

Write or delete on the same handler

Overall Risk Severity

Critical

Likelihood Score

7.67/ 9

Impact Score

6.67/ 9

Risk Score

5.68/ 9

Escalation Path

Read primitive — private keys and credentials are exposed

Highest-Value Fix

Map an opaque identifier to a server-side path instead of taking a filename

Step by step

Values used
How the file path is built = User input concatenated onto a base path — 9; Canonicalisation before the check = Deny-list of traversal sequences — 8; Encoding handling = Decoded exactly once — 6; Filesystem confinement = A dedicated data directory — 6; Sensitive files readable by the process = Private keys and credentials — 8; Write or delete on the same handler = Writes go to a separate directory — 6
Path Traversal Risk
Likelihood = mean(path construction, canonicalisation, encoding handling); impact = mean(filesystem confinement, reachable secrets, write access).
Overall Risk Severity
= Critical
Likelihood Score
= 7.67 / 9
Impact Score
= 6.67 / 9
Risk Score
= 5.68 / 9
Escalation Path
= Read primitive — private keys and credentials are exposed
Highest-Value Fix
= Map an opaque identifier to a server-side path instead of taking a filename

How it works

Any check performed before canonicalisation can be defeated, so decoding once and comparing strings scores 6 while resolving the real path and testing the prefix scores 1. Impact turns on confinement: the same traversal is an application-file read in a locked container and a private-key theft on a host filesystem. Traversal that reaches a write is an RCE in disguise — overwrite a cron file, a template or a startup script and the read-only bug becomes code execution.

Formula

Path Traversal Risk

Likelihood = mean(path construction, canonicalisation, encoding handling); impact = mean(filesystem confinement, reachable secrets, write access).

canonical: 1 real path resolved and prefix-checked … 9 no checking
writeAccess: 3 read-only … 9 same handler writes

Frequently Asked Questions

How is Path Traversal Risk calculated?

Likelihood = mean(path construction, canonicalisation, encoding handling); impact = mean(filesystem confinement, reachable secrets, write access). Any check performed before canonicalisation can be defeated, so decoding once and comparing strings scores 6 while resolving the real path and testing the prefix scores 1. Impact turns on confinement: the same traversal is an application-file read in a locked container and a private-key theft on a host filesystem.

Why does Path Traversal Risk matter?

Traversal that reaches a write is an RCE in disguise — overwrite a cron file, a template or a startup script and the read-only bug becomes code execution.

What values do I need to enter?

This calculator takes 6 inputs: How the file path is built, Canonicalisation before the check, Encoding handling, Filesystem confinement, Sensitive files readable by the process, Write or delete on the same handler. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is stripping '../' the wrong defence?

Because the encodings outnumber the filter: %2e%2e%2f, double-encoded forms, UTF-8 overlongs, backslashes on Windows, absolute paths and symlinks all bypass a sequence-stripping filter, and stripping can even create a traversal from an innocent string. Resolve the path, then verify it is inside the base directory.

You might also need

File Upload Risk Calculator SSRF Risk Calculator Input Validation Coverage Calculator