Path traversal is a security flaw that lets an attacker reach files an app was never supposed to share. The app means to work inside one folder, but the attacker sends a specially crafted file path, often using the characters ../ to mean “go up one folder,” and climbs out of it. Picture a library clerk who fetches any book from the shelf you name. Someone asks for “the shelf behind the staff door,” and because the clerk never checks, private files leave with the books.
Why it matters
Many AI tools let you upload documents or download results, and that is where this flaw often shows up. If a tool has it, an attacker may be able to read configuration files, passwords or other users’ data, or plant files of their own. For a small organization, that could put donor lists or client records within reach of a stranger. When you compare vendors, ask how they check file names and paths on uploads and downloads, and how quickly they fix reported flaws. Related problems include remote code execution and server-side request forgery. We track known cases in our advisories.
Published Updated