Path traversal: request path into a filesystem sink, no containment
Part of the AI-generated code risks check · fix arrives as a pull request
What it is
A path segment or filename from the request reaches a filesystem call — read, write, unlink, or a static-file send — without being confined to an intended directory.
Why it matters
A ../ sequence walks out of the folder you meant. Depending on the sink, that reads /etc/passwd and your .env, or writes a file somewhere it will later be executed.
How to fix it
Resolve the joined path and confirm it still starts with the base directory before touching it. Better still, do not use request input as a path at all — map an opaque id to a server-side filename through a lookup you control.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.