Build fluency in the vocabulary of escaping an intended base directory via unvalidated, attacker-supplied file paths.
0 / 5 completed
1 / 5
A teammate explains that a web application concatenates a user-supplied filename directly onto a base directory path, and an attacker supplies a filename containing repeated parent-directory segments to escape the intended directory and read arbitrary files. What vulnerability is being described?
Path traversal is exactly this: a web application concatenates a user-supplied filename directly onto a base directory path without validation, and an attacker supplies a filename containing repeated parent-directory segments, such as multiple dot-dot-slash sequences, to escape the intended directory and read or write arbitrary files elsewhere on the filesystem. A hash collision is an unrelated hash-table concept about two keys sharing a bucket. This escape-the-base-directory-via-parent-segments approach is exactly why unvalidated filename concatenation is treated as a critical vulnerability.
2 / 5
During a security review, the team discovers a file-download endpoint builds the file path by directly concatenating a user-supplied filename query parameter onto a fixed uploads directory, without normalizing or restricting the result to that directory. Which risk does this represent?
This represents a path-traversal vulnerability, since a filename containing repeated parent-directory segments could escape the uploads directory and expose arbitrary files on the server, such as configuration files or credentials. Normalizing the resulting path and verifying it still resides inside the uploads directory before serving it would instead close off that escape route. This concatenate-without-restricting-to-the-directory behavior is exactly why raw filename concatenation is flagged once the filename comes from user input.
3 / 5
In a code review, a dev notices a download endpoint joins a user-supplied filename parameter directly onto a fixed base directory using simple string concatenation, without normalizing the resulting path or checking that it stays within the base directory. What does this represent?
This is a path-traversal risk, since a filename with repeated parent-directory segments could resolve to a path outside the intended base directory. A cache eviction policy is an unrelated concept about discarded cache entries. This unnormalized-string-concatenation pattern is exactly the kind of vulnerability a reviewer flags once the filename originates from user input rather than a trusted internal source.
4 / 5
An incident report shows an attacker read a server's internal configuration file, including database credentials, by supplying a download filename containing repeated parent-directory segments that escaped the intended uploads directory. What practice would prevent this?
Normalizing the resulting file path and verifying it still resides within the intended base directory before serving any file ensures parent-directory segments can never escape that boundary. Continuing to concatenate the user-supplied filename directly onto the base directory regardless of what parent-directory segments the filename might contain is exactly what let the attacker read the configuration file in this incident. This normalize-and-verify-containment approach is the standard fix once unvalidated filename concatenation is confirmed to be exploitable.
5 / 5
During a PR review, a teammate asks why the team insists on normalizing and verifying file paths stay within a base directory instead of just trusting filenames that come from an authenticated user's own request. What is the reasoning?
Normalizing and verifying containment trades a small amount of extra path-handling code for closing off directory-escape attacks entirely, while trusting an authenticated user's filename ignores that authentication says nothing about whether the supplied value itself is well-formed or malicious. This is exactly why path normalization and containment checks are mandatory for any user-influenced file path, regardless of whether the requesting user is authenticated.
What does the "Path Traversal Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to path traversal vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 11 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.