Path traversal (ARCH7103)

Key php.security.path-traversal · Severity error · Category security · CWE CWE-22

Building a file path from user input without normalization lets attackers use ../ sequences to escape the intended directory and reach arbitrary files. The resolved path must be confined to the base directory.

Incorrect

<?php
$file = $_GET['file'];
echo file_get_contents("/var/www/uploads/$file");

Correct

<?php
$base = '/var/www/uploads';
$path = realpath($base . '/' . $_GET['file']);
if ($path === false || !str_starts_with($path, $base . '/')) {
    http_response_code(400);
    exit;
}
echo file_get_contents($path);

Fix

Resolve the path with realpath() and verify the result stays inside the allowed base directory.