# Cwe 22 Path Traversal

> Use this skill when you need to remediate CWE-22 (Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing improper limitation of a pathname to a restricted directory (path traversal) issues.

- Skill: `developerscoffee/cwe-22-path-traversal` (Agent Skill)
- Install (CLI): `npx skillmds@latest add developerscoffee/cwe-22-path-traversal`
- Raw SKILL.md: https://api.skillmd.com/api/skills/developerscoffee/cwe-22-path-traversal/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: DevelopersCoffee (https://skillmd.com/u/developerscoffee)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/developerscoffee/cwe-22-path-traversal

---


# CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

## Description

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

Reference:
https://cwe.mitre.org/data/definitions/22.html


**OWASP Category**: A01:2021 – Broken Access Control


---

## Vulnerable Pattern


### ❌ Example 1

```java
    private ResponseEntity<GenericVulnerabilityResponseBean<String>> readFile(
            Supplier<Boolean> condition, String fileName) {
        if (condition.get()) {
            InputStream infoFileStream =
                    this.getClass().getResourceAsStream("/scripts/PathTraversal/" + fileName);
            if (infoFileStream != null) {
                try (BufferedReader reader =
                        new BufferedReader(new InputStreamReader(infoFileStream))) {
                    String information = reader.readLine();
                    StringBuilder payload = new StringBuilder();
                    while (information != null) {
                        payload.append(information);
                        information = reader.readLine();
                    }
                    return new ResponseEntity<GenericVulnerabilityResponseBean<String>>(
                            new GenericVulnerabilityResponseBean<>(payload.toString(), true),
                            HttpStatus.OK);
                } catch (IOException e) {
                    LOGGER.error("Following error occurred: ", e);
                }
            }
        }
        return new ResponseEntity<GenericVulnerabilityResponseBean<String>>(
                new GenericVulnerabilityResponseBean<>(), HttpStatus.OK);
    }
```





---

## Deterministic Fix



---

## Detection Pattern

Look for these patterns in your codebase:


```bash
# Find File constructor with user input
grep -rn "new File(" --include="*.java" | grep -E "\+|getParameter"
```


```bash
# Find path operations
grep -rn "Paths.get\|Files.read\|Files.write" --include="*.java"
```



---

## Remediation Steps


1. Normalize file paths using Path.normalize() or Paths.get().normalize()

2. Validate the canonical path is within allowed directory

3. Use allowlist for permitted file names or extensions

4. Reject paths containing .. or absolute paths

5. Use secure file APIs that prevent traversal


---

## Key Imports

```java

import java.nio.file.Path;

import java.nio.file.Paths;

import java.io.File;

```

---

## Verification

After remediation:


- Re-run SAST scan - CWE-22 should be resolved

- Test with traversal payloads: ../../../etc/passwd

- Verify access is restricted to intended directory


---

## Trigger Examples

```
Fix CWE-22 vulnerability
Resolve Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) issue
Secure this Java code against improper limitation of a pathname to a restricted directory (path traversal)
SAST reports CWE-22
```

---

## Common Vulnerable Locations

| Layer | Files | Patterns |
|-------|-------|----------|

| Controller | `*Controller.java` | File download/upload |

| Service | `*Service.java` | File processing |

| Utility | `*Util.java` | File operations |


---

## References


- [CWE-22: Path Traversal](https://cwe.mitre.org/data/definitions/22.html)

- [OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)


---

**Source**: Generated by [Java CWE Security Skills Generator](https://github.com/DevelopersCoffee/java-cwe-security-skills)
**Last Updated**: 2026-03-07