Zennoxa Shield
Rules / PHP
SHIELD-PHP-010

Path traversal via file read with request data

highPHPCWE-22CVSS 8.6

What it detects

File read function receives request data directly, allowing path traversal to arbitrary files.

How to fix

Canonicalize with realpath() and confirm the path stays within an allowed base directory.

Vulnerable — Shield flags thisdownload.php
<?php
// Document download — vulnerable to path traversal (?file=../../etc/passwd)
header('Content-Type: text/plain');
readfile('/var/app/uploads/' . $_GET['file']);
Fixed — scans cleandownload.php
<?php
// Canonicalize and confirm the file stays inside the uploads directory
$base = '/var/app/uploads/';
$path = realpath($base . ($_GET['file'] ?? ''));
if ($path === false || strncmp($path, $base, strlen($base)) !== 0) {
    http_response_code(403);
    exit;
}
header('Content-Type: text/plain');
readfile($path);

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-010, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-010: Path traversal via file read with request data — Zennoxa Shield