Path traversal test payload list

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Decide on the string before touching the file system: undo percent-encoding (repeatedly, since payloads are often double-encoded), treat backslashes as separators, refuse absolute, drive and URL paths, normalise, then refuse anything that climbs out. It gives the same answer on Windows and Linux. Better still, store uploads under a name you generate.

import posixpath
from urllib.parse import unquote

def safe_relative(user_path):
    p = user_path
    try:
        for _ in range(3):
            p = unquote(p, errors="strict")
    except UnicodeDecodeError:
        raise ValueError("invalid UTF-8 once decoded") from None
    p = p.replace("\\", "/")
    if "\0" in p:
        raise ValueError("contains a NUL byte")
    if p.startswith("/") or ":" in p:
        raise ValueError("absolute, drive or URL path")
    p = posixpath.normpath(p)
    if p == ".." or p.startswith("../"):
        raise ValueError("climbs out of the folder")
    if any(seg.endswith((".", " ")) for seg in p.split("/")):
        raise ValueError("has a segment Windows would rewrite")
    return p

with open("path-traversal-payloads.txt", encoding="utf-8") as f:
    payloads = [line.strip() for line in f if line.strip()]
for p in payloads:
    try:
        print("allowed:", safe_relative(p))
    except ValueError as e:
        print(f"blocked {p!r}: {e}")

Run against this file, it prints: blocked '../../../etc/passwd': climbs out of the folder blocked '..\\..\\..\\windows\\win.ini': climbs out of the folder blocked '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd': climbs out of the folder blocked '%252e%252e%252fetc%252fpasswd': climbs out of the folder blocked '..%c0%af..%c0%afetc/passwd': invalid UTF-8 once decoded blocked '....//....//etc/passwd': has a segment Windows would rewrite blocked '..%2F..%2F..%2Fetc%2Fpasswd': climbs out of the folder blocked '/var/www/../../etc/passwd': absolute, drive or URL path blocked 'file:///etc/passwd': absolute, drive or URL path blocked '\\\\?\\C:\\windows\\win.ini': absolute, drive or URL path blocked 'C:../../../windows/win.ini': absolute, drive or URL path blocked '..%00/etc/passwd': contains a NUL byte