Path Traversal Check — Can /files/../../.env Read Your Secrets?
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.
What the issue is
A download endpoint that joins the raw request value onto a directory can be walked out of that directory with ../ — reading .env, database files, or system files.
Why AI tools generate it
AI scaffolds wire file downloads with path.join(dir, param) because the happy path works; the containment check is invisible in every demo.
How DevMeth detects it
A code scan flags readFile/createReadStream/sendFile/download calls in server handlers whose path derives from route params, query values, or body fields with no basename or resolve+prefix containment nearby. Contained reads are not flagged.
File endpoints pass user-supplied paths to the filesystem
WHAT WE FOUND
C44 — masked sample
The fix, in three steps
Reduce the request value with path.basename and re-anchor it to the serving directory — or resolve and verify a directory prefix before every read.
Run a free scan and each finding carries a paste-ready fix prompt you can act on.
Try a free scanFAQ
The endpoint only serves one directory — how is this exploitable?
The directory is where the join STARTS, not where it ends: join('/uploads', '../../.env') resolves outside it. The attack is in the value, not the config.
Doesn't the framework block ../ in params?
Routing decodes parameters for you — %2e%2e%2f arrives at your handler as ../. Some servers normalize URL paths, but body fields and query values are passed through untouched. Assume the raw value arrives.
What's the fix?
`path.basename(name)` then join to the serving directory, or `path.resolve` + `startsWith(resolvedBase + sep)` before every read. Both are one line at each sink.
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.