Path traversal (ARCH4103)

Key java.security.path-traversal · Severity error · Category security · CWE CWE-22

Building a file path from untrusted input without normalization and containment lets ../ sequences reach files outside the intended directory.

Incorrect

String name = request.getParameter("file");
File f = new File("/var/data/" + name);
return Files.readAllBytes(f.toPath());

Correct

Path base = Paths.get("/var/data").toRealPath();
Path target = base.resolve(name).normalize();
if (!target.startsWith(base)) throw new SecurityException();
return Files.readAllBytes(target);

Fix

Normalize the path and verify the resolved target stays within the base directory using startsWith.