Which vulnerability allows an attacker to access files outside the web root by using path traversal sequences such as '../'?

• A. SQL Injection
• B. Cross-Site Scripting
• C. Directory Path Traversal
• D. Buffer Overflow

Answer: (C)

Path traversal vulnerability arises when an application uses user input to form a file path without validating or constraining it. Attackers can include sequences like ../ to move up the directory tree and reach files outside the intended web root, potentially exposing sensitive files. This is exactly what a directory path traversal attack exploits—disrupting the boundary between the web root and the rest of the filesystem. To prevent it, validate and sanitize input, canonicalize the path, and ensure the final path cannot escape a designated root (often by using a restricted base directory, sandboxing, or proper access controls). The other issues involve different risks: SQL Injection targets databases, Cross-Site Scripting affects client-side scripts in the browser, and Buffer Overflow relates to memory management, not filesystem path access.