How do you identify and prevent directory traversal attacks in file uploads?

Question

Anubhav Kumar · Answer

Directory traversal attacks (also known as path traversal) aim to access files and directories outside the intended file system structure by manipulating file paths (e.g., using
../ to escape the intended directory). Preventing such attacks in 
file uploads is critical.
Here’s how to identify and prevent directory traversal in file uploads:
1. Understanding the Attack
Example
POST /upload
filename=../../../../etc/passwd
If the server directly uses this filename, it may write to a sensitive path or overwrite system files.
Prevention Techniques
1. Never Trust User Input for File Paths
Always treat uploaded filenames as untrusted input.
2. Sanitize the Filename
Strip or reject any path-related characters like ../, \,
/, null bytes, etc.
Example in C#:
string fileName = Path.GetFileName(uploadedFile.FileName); // strips path
Example in Python:
import os
file_name = os.path.basename(uploaded_file.filename)  # safe filename
3. Use a Safe Upload Directory
Ensure uploaded files are stored in a dedicated directory:
/uploads/user-content/
Do not store uploads in root, config, or executable directories.
4. Enforce File Name Policies
Use a whitelist of allowed characters.Replace user-supplied names with UUIDs or safe generated names:
var safeFileName = Guid.NewGuid().ToString() + Path.GetExtension(fileName);
5. Validate File Type and Size
Check file extensions (.jpg, .pdf, etc.)Use MIME type verification and file signature checks (e.g., magic numbers)Limit file size to prevent DoS
6. Prevent Null Byte Injection
Some languages (e.g., older PHP versions) are vulnerable to null byte injections (%00) which can terminate strings early.
Validate and sanitize string input to remove %00 or \0
Additional Hardening
Server-Side Access Control - Ensure the web server does 
not allow access to the upload directory for direct execution (e.g., disable
.php or .exe from running).Chroot or Containerize Uploads - Use sandboxing techniques (e.g., Docker, chroot) to isolate file upload processing.
Detection (Logging and Monitoring)
Log all uploaded filenames and paths.Flag suspicious patterns like ../, ..%2F, \..\,
%5C, or Unicode variants.Monitor for unusually structured or nested paths.
Summary Checklist
Security Step
Implemented?
Strip path components from filename
Yes
Store in a fixed safe directory
Yes
Replace filename with UUID
Yes
Validate file type and size
Yes
Prevent null byte injections
Yes
Disable code execution in upload dir
Yes
and

forum

How do you identify and prevent directory traversal attacks in file uploads?

Ravi Vishwakarma

Can you answer this question?

1 Answers

1. Understanding the Attack

Example

Prevention Techniques

1. Never Trust User Input for File Paths

2. Sanitize the Filename

Example in C#:

Example in Python:

3. Use a Safe Upload Directory

4. Enforce File Name Policies

5. Validate File Type and Size

6. Prevent Null Byte Injection

Additional Hardening

Detection (Logging and Monitoring)

Summary Checklist

Liked By

Security Step	Implemented?
Strip path components from filename	Yes
Store in a fixed safe directory	Yes
Replace filename with UUID	Yes
Validate file type and size	Yes
Prevent null byte injections	Yes
Disable code execution in upload dir	Yes