Rate directory traversal risk from how file paths are built and canonicalised, and what the process can read or overwrite.
Any check performed before canonicalisation can be defeated, so decoding once and comparing strings scores 6 while resolving the real path and testing the prefix scores 1. Impact turns on confinement: the same traversal is an application-file read in a locked container and a private-key theft on a host filesystem. Traversal that reaches a write is an RCE in disguise — overwrite a cron file, a template or a startup script and the read-only bug becomes code execution.
Path Traversal Risk
Likelihood = mean(path construction, canonicalisation, encoding handling); impact = mean(filesystem confinement, reachable secrets, write access).
Likelihood = mean(path construction, canonicalisation, encoding handling); impact = mean(filesystem confinement, reachable secrets, write access). Any check performed before canonicalisation can be defeated, so decoding once and comparing strings scores 6 while resolving the real path and testing the prefix scores 1. Impact turns on confinement: the same traversal is an application-file read in a locked container and a private-key theft on a host filesystem.
Traversal that reaches a write is an RCE in disguise — overwrite a cron file, a template or a startup script and the read-only bug becomes code execution.
This calculator takes 6 inputs: How the file path is built, Canonicalisation before the check, Encoding handling, Filesystem confinement, Sensitive files readable by the process, Write or delete on the same handler. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because the encodings outnumber the filter: %2e%2e%2f, double-encoded forms, UTF-8 overlongs, backslashes on Windows, absolute paths and symlinks all bypass a sequence-stripping filter, and stripping can even create a traversal from an innocent string. Resolve the path, then verify it is inside the base directory.