Definition
Directory traversal, also known as path traversal or dot-dot-slash, is a web security vulnerability that allows an attacker to access files and directories outside of the intended web root folder. Attackers exploit this by manipulating variables that reference files with dot dot slash (./) components, effectively navigating up the directory tree. This vulnerability is critical because it can expose sensitive system files, configuration data, or even allow arbitrary code execution. For example, an attacker might use a URL like `http://example.com/download.php?file=././etc/passwd` to view the system's user list. Unlike SQL injection, which targets database queries, directory traversal targets the file system's hierarchical structure. This concept is fundamental to cybersecurity certifications like CompTIA Security+ and CySA+.