path-traversal
Safeguard articles tagged "path-traversal" — guides, analysis, and best practices for software supply chain and application security.
51 articles
spring-webmvc Security: Known CVEs and How to Stay Patched
A security guide to the spring-webmvc Maven dependency: recent path traversal CVEs, affected version ranges, and how to keep this core Spring artifact patched.
adm-zip npm Security: Zip Slip Risks and Safe Extraction
adm-zip is a popular pure-JavaScript zip library for Node.js, and its history of path-traversal flaws makes safe extraction non-optional. Here is what went wrong and how to use it correctly.
Zip Slip: archive extraction path traversal explained
Zip Slip lets malicious archives write files outside their extraction folder via ../ paths — how it works, real CVEs, and how to detect and fix it.
Java URL Decode: Doing It Safely Without Opening Holes
Java URL decode looks trivial until you hit double-decoding and encoding mismatches. Here is how to decode URLs in Java correctly and where the security bugs hide.
CVE-2022-31159: Path Traversal in the AWS SDK for Java
CVE-2022-31159 is a partial path traversal flaw in the AWS SDK for Java v1's S3 TransferManager. Here is who it affects, how it works, and how to fix it.
What is Path Traversal
Path traversal (CWE-22) lets attackers escape a web root using ../ sequences to read or write arbitrary files. Here's how it works, real breaches, and fixes.
What is Directory Traversal
Directory traversal (CWE-22) lets attackers use ../ sequences to read or write files outside a web app's root directory. Here's how it works.
What is Zip Slip Vulnerability
Zip Slip lets attackers escape archive extraction via path traversal to overwrite files and gain code execution. Here's how it works and how to stop it.
CVE-2021-29425: The Commons IO Path Traversal Bug
CVE-2021-29425 shows how a single unhandled case in Apache Commons IO's path normalization let attackers slip past directory checks that assumed a canonicalized path was actually safe.
CVE-2022-24785: The Moment.js Path Traversal, Explained
A user-controlled locale string was all it took: how CVE-2022-24785 let attackers traverse paths through Moment.js locale loading on Node.js, and why the fix is a one-line upgrade.
OWASP Path Traversal: How It Works and How to Stop It
Path traversal lets an attacker reach files outside a web app's intended directory using sequences like ../../etc/passwd — here's how it works and the fixes that actually close it.
ScreenConnect CVE-2024-57727 Path Traversal Detailed
CVE-2024-57727 is a path traversal in ConnectWise ScreenConnect enabling arbitrary file read on self-hosted instances. Chain, detection, and patching.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.