Attack scenario
Path traversal and file inclusion
An adversary manipulates a file path or imported name and reads, writes, or executes content outside the permitted directory.
Why this scenario matters
Sequences such as ../, alternate encoding, absolute paths, symlinks, or wrapper schemes may bypass weak validation. Impact includes reading configuration and secrets, overwriting files, or local and remote file inclusion.
Applications should use server-controlled identifiers rather than paths, canonicalization, directory and type allowlists, isolated storage, least privilege, and testing of encoded variants.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Collection
- Credential Access
- Initial Access
- Stealth
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.