path-traversal
Safeguard articles tagged "path-traversal" — guides, analysis, and best practices for software supply chain and application security.
51 articles
Path Traversal Prevention in Ruby with File.realpath
How File.realpath stops path traversal in Ruby apps, why File.expand_path alone fails, and what real CVEs like Sprockets' CVE-2018-3760 reveal about secure file handling.
Path Traversal Prevention in Rust with fs::canonicalize
fs::canonicalize resolves `..` and symlinks into one absolute path, but it can't fix TOCTOU races, missing files, or Windows prefix quirks on its own. Here's the safe pattern.
Path Traversal Prevention in C++ with std::filesystem::we...
Why std::filesystem::weakly_canonical alone doesn't stop path traversal in C++, and the containment check every extraction, upload, or plugin loader needs beside it.
Windsurf CVE-2025-62353: Path Traversal in Cascade and the IDEsaster Wave
HiddenLayer's CVSS 9.8 Windsurf flaw exfiltrated secrets even with write_to_file on the deny list. The Cascade agent's filesystem trust broke wide open.
Is vite-plugin-static-copy Safe? Understanding CVE-2025-57753 and Path Traversal
vite-plugin-static-copy is a popular Vite asset plugin, but one version range shipped a directory traversal flaw. Here is what to know and how to patch.
CVE-2018-1271: Path traversal in Spring MVC static resour...
A path traversal flaw in Spring MVC's static resource handling let attackers on Windows deployments escape the web root and read arbitrary files.
Is the jsPDF npm Package Safe? A Security Review
The jsPDF npm package is widely used for client-side PDF generation, but recent path traversal and ReDoS advisories mean the version you pin matters. Here is what to check.
How Snyk Code detects path traversal vulnerabilities thro...
How Snyk Code uses interprocedural data-flow tracing—not regex matching—to catch path traversal (CWE-22) by connecting tainted sources to file-system sinks.
Zip Slip vulnerability cheat sheet
A concrete, question-driven cheat sheet on Zip Slip: how the archive-extraction path traversal bug works, real CVEs, and how to detect and fix it.
Preventing path traversal (directory traversal) attacks
Path traversal lets attackers read or write files outside a web app's directory using ../ sequences. Here's how it works and how to stop it.
webpack-dev-middleware Security: The CVE-2024-29180 Path Traversal Fix
webpack-dev-middleware serves your bundle in development, but CVE-2024-29180 let a crafted URL read any file off a developer's machine. Here is the fix.
Archiver npm: A Security Review and Safe-Usage Guide
The archiver npm package builds zip and tar streams cleanly, but the real risks are on the extraction side and in its dependency tree. Here is how to use it safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.