A request to /download?file=../../etc/passwd returns the system file. This is…
Options
- Path traversal (Correct option)
- SQL injection
- CSRF
- Race condition
Answer
Path traversal
Why
../ means 'go up one folder'. By chaining them, the attacker escapes the downloads folder and reads any file the server can access.
That is path traversal.
Fix: never use raw user input as a file path. Map IDs to files on the server, or resolve the final path and check it is still inside the allowed folder.
Remember
User input in file paths → path traversal risk.