Path traversal (ARCH303)

Key dotnet.security.path-traversal · Severity error · Category security · CWE CWE-22

Joining a user-supplied file name directly into a path allows ../ sequences to escape the intended directory. The path must be normalized and constrained to a root.

Incorrect

var path = Path.Combine(uploadDir, userFileName);
var bytes = File.ReadAllBytes(path);

Correct

var fullRoot = Path.GetFullPath(uploadDir);
var path = Path.GetFullPath(Path.Combine(fullRoot, userFileName));
if (!path.StartsWith(fullRoot + Path.DirectorySeparatorChar))
    throw new UnauthorizedAccessException();
var bytes = File.ReadAllBytes(path);

Fix

Resolve the combined path with Path.GetFullPath and verify the result stays under the allowed root directory.