Path Traversal

Path Traversal occurs when a user-supplied filename or path is used to construct a filesystem operation without being properly sanitized. By injecting ../ sequences (or their URL-encoded equivalents), attackers navigate outside the intended directory — reading sensitive files like /etc/passwd or private keys, overwriting configuration, or in some cases achieving code execution by writing to locations where the runtime will later execute them.

It commonly appears in file upload handlers, static file servers, export features, and PDF/document generation — exactly the kind of utility code that gets added in a PR and reviewed quickly. The jsPDF path traversal (CVE-2025-68428) exploited a PDF export feature that wrote files to a path derived from user input without normalizing ../ sequences.

PullLight checks all filesystem operations (fs.readFile, fs.writeFile, path.join with user input) and flags paths that include user-controlled components without path.normalize() followed by a directory prefix check.