A directory traversal attack, also known as the dot dot slash attack (../) or directory climbing, targets restricted directories on web servers. For example the root directory prevents users from accessing confidential files on the server. The directory traversal attack exploits HTTP vulnerabilities and server software bugs and misconfigurations so that attackers can execute commands outside the root directory, access confidential files, and even damage the server.

A web vulnerability scanner should be used to scan the website and check for directory traversal vulnerabilities as well as other web vulnerabilities that can lead to SQL injection, cross-site scripting, and other attacks. It is important that the latest version of web server software is running on the server and that all patches have been applied. When a request for a file is made, build a full path to the file if it exists. Finally, all user input should be filtered, validated, and sanitized (e.g., “%20” should be converted to spaces).