What is Directory Traversal?

Directory traversal, also known as path traversal, is a vulnerability that lets an attacker read, and sometimes write, files outside the folder a web application is supposed to stay within. Websites frequently open files based on a name supplied in a request, such as a template, a download or an image. If that name is not properly checked, an attacker can supply a path that climbs out of the intended directory and reaches sensitive files elsewhere on the server.

What is directory traversal and why is it dangerous?

The danger of directory traversal is access to files that were never meant to be public. Depending on the flaw and the server, an attacker might read configuration files containing database passwords, application source code, private keys, or system files that reveal user accounts. On a WordPress site, the prize is often wp-config.php, which holds the database credentials and secret keys. In more severe cases, traversal combined with a file-write or upload feature can let an attacker place their own code on the server and run it, turning file access into full compromise.

How directory traversal works

The attack relies on special path sequences that mean go up one folder. By chaining several of these together, an attacker walks up from the application’s working directory to the root of the filesystem, then back down to a target file. For example, a page that loads a file named in a URL parameter might be tricked into opening a system password file instead of the harmless document it expected. The root cause is the same as with other injection flaws: untrusted input being used directly, this time as part of a file path.

What attackers look for

• Configuration files such as wp-config.php or environment files holding credentials.
• Source code, which can reveal further vulnerabilities and secrets.
• System files that expose user accounts and server details.
• Log files, which can sometimes be abused to escalate the attack.

How to prevent directory traversal

• Avoid using user input in file paths wherever possible. Reference files by a fixed identifier that maps to a known safe path.
• Use an allowlist of permitted files or folders rather than trying to block bad input.
• Normalise and validate paths, resolving the final path and confirming it still sits inside the intended directory before opening it.
• Apply least privilege, so the web server can only reach the files it genuinely needs.

Directory traversal on WordPress

WordPress core guards against traversal in its own file handling, so the usual source of these flaws is plugins and themes that accept a filename or path from a request and open it without validation. Because a single vulnerable plugin can expose wp-config.php, keeping everything patched is critical, as explained in our guide on WordPress plugin and theme vulnerabilities. A closely related risk is leaving sensitive files reachable in the first place, covered in what an exposed .env file is.

A real-world example of directory traversal

To see how ordinary this vulnerability is, picture a common feature: a plugin that lets users download a document by passing its filename in a link, something like a download page that takes a name parameter and returns the matching file from a documents folder. The developer assumed the name would always be a simple filename, so the code joins it to the documents folder and opens whatever results. An attacker ignores that assumption and instead supplies a value made up of repeated go-up sequences followed by a path to a sensitive file. The application faithfully builds that path, climbs out of the documents folder, and returns the contents of a configuration file or a system file instead. No password was cracked and no clever exploit chain was needed; the attacker simply asked for a different file and the site handed it over. This is why the fix is never to blocklist a few bad characters but to validate that the final resolved path still lives inside the folder it is supposed to, and to prefer fixed identifiers over raw filenames entirely.

How to check your site for directory traversal risk

Traversal flaws hide in file-handling features across plugins and custom code, and sensitive files can also be left exposed by misconfiguration. Run a security scan with EzyAudit AI and we check for exposed sensitive files and the misconfigurations that make traversal and file disclosure possible, explaining each finding clearly. See the full list of checks we run. For detailed technical guidance, the OWASP path traversal resource is the authoritative reference.

Directory traversal can quietly hand attackers your most sensitive files, but careful path handling shuts it down. Scan your website now to see whether any sensitive files are exposed.