Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) |
| OWASP | A05:2017 - Broken Access Control |
| Confidence Level | Medium |
| Impact Level | Medium |
| Likelihood Level | High |
Description#
Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn’t. To prevent this, check dynamic template paths against a predefined allowlist to make sure it’s an allowed template.