The endpoint only serves one directory — how is this exploitable?

The directory is where the join STARTS, not where it ends: join('/uploads', '../../.env') resolves outside it. The attack is in the value, not the config.

Doesn't the framework block ../ in params?

Routing decodes parameters for you — %2e%2e%2f arrives at your handler as ../. Some servers normalize URL paths, but body fields and query values are passed through untouched. Assume the raw value arrives.

`path.basename(name)` then join to the serving directory, or `path.resolve` + `startsWith(resolvedBase + sep)` before every read. Both are one line at each sink.

C44

Input handling

Path Traversal Check — Can /files/../../.env Read Your Secrets?

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.

What the issue is

A download endpoint that joins the raw request value onto a directory can be walked out of that directory with ../ — reading .env, database files, or system files.

Why AI tools generate it

AI scaffolds wire file downloads with path.join(dir, param) because the happy path works; the containment check is invisible in every demo.

How DevMeth detects it

A code scan flags readFile/createReadStream/sendFile/download calls in server handlers whose path derives from route params, query values, or body fields with no basename or resolve+prefix containment nearby. Contained reads are not flagged.

C44

What a finding looks like

High

File endpoints pass user-supplied paths to the filesystem

WHAT WE FOUND

C44 — masked sample

Sample — illustrative and masked exactly as a real report shows it. Run a free scan to see your own results.

The fix, in three steps

Reduce the request value with path.basename and re-anchor it to the serving directory — or resolve and verify a directory prefix before every read.

Run a free scan and each finding carries a paste-ready fix prompt you can act on.

Try a free scan

FAQ

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.