Path Traversal: The CVSS 10 Bug Class in Your Own App

In September 2026, GitLab shipped an emergency patch for CVE-2026-85706 - a path traversal bug in its Repository Commits API that a stranger can trigger with a single unauthenticated HTTP request to read any file on the server. It scored a perfect CVSS 10.0, and CISA added it to the Known Exploited Vulnerabilities catalog within days because attackers were already probing for it in the wild.

You probably do not run a self-hosted GitLab. But the bug class behind that headline - path traversal - is one of the oldest and most common ways a web app leaks files it never meant to expose, and it shows up in AI-generated code more often than you would guess. Here is what it actually is, and how to tell if your own app has the same shape of hole.

What is path traversal, in plain terms

Path traversal (also called directory traversal or, when it is used to read files, Local File Inclusion) happens when an app builds a file path out of user input without checking where that path actually points. The classic trick is the ../ sequence - "go up one directory." Chain enough of them and you climb out of the folder the app meant to serve from, all the way to sensitive files.

Say your app serves user avatars from a route like /download?file=cat.png. If the server just does "read the file named whatever file says, inside the uploads folder," then an attacker changes it to /download?file=../../../../etc/passwd and the server happily walks up and out, handing back a system file. On a Node app the prize is usually .env, config.json, or the source that holds your database URL and API keys.

Why AI-generated apps ship path traversal

The same reason they ship most security gaps: the model optimizes for "does this work," and a naive file handler works perfectly in a demo. Ask a copilot to "add an endpoint to download a report" or "serve files from an uploads folder" and you frequently get code that concatenates user input straight onto a filesystem path with no validation. It passes your click-through, because you only ever click the legitimate link.

The patterns to grep for

• A path built by string-joining request input: path.join(dir, req.query.file) or fs.readFile(`./uploads/${name}`) where name comes from the user.
• A dynamic require() or import whose argument is user-controlled - traversal into code, not just data.
• A route parameter or slug passed to file reads, ZIP extraction, or template loading without a check that the resolved path stays inside the intended directory.
• "Send this file" helpers (res.sendFile, send) pointed at a raw user value instead of a safelisted name.

How to close it

1. Never trust the input as a path. Resolve it, then verify the result still lives under your intended base directory (compare the fully resolved path against the base before you read).
2. Prefer a safelist. Map an opaque id to a known file server-side rather than accepting a filename at all - id=42 beats file=report.pdf.
3. Strip and reject traversal sequences (../, null bytes, absolute paths, URL-encoded variants like %2e%2e%2f) - but treat this as a backstop, not your only defense.

The other lesson from CVE-2026-85706: patch your dependencies

Even if your own code is clean, this class of bug lives in the frameworks and packages you pull in. GitLab is a mature product with a security team, and it still shipped a 10.0. Your AI-generated package.json is pulling in dozens of transitive dependencies you have never read, any of which can turn a patched app into a vulnerable one overnight. An app that was secure at scaffold time drifts out of date within weeks - the same point we make in the Next.js security checklist.

The takeaway CISA hammered on GitLab applies to you too: know what you are running, and patch the known-exploited stuff first. For your dependencies that means keeping a real inventory and watching for CVEs against it, instead of finding out from a breach.

How Trust checks for this

Trust scans a live URL with DAST - firing traversal and file-read payloads at your deployed app the way an attacker would, plus 10,000+ Nuclei templates that include known CVEs like this one as templates land. It also scans your GitHub repo for hardcoded secrets (the exact files a traversal bug would leak) and checks every dependency against the OSV database, so a vulnerable package shows up with the CVE and the version to upgrade to. If most of your app was generated, start with is an AI-generated app secure? and then run the scan.

Building in Cursor or Claude Code? Wire Trust in as an MCP server so your assistant can scan for this class of bug as it writes the file handler - before it ever reaches your live URL. You can see the full list of what it detects on the detectors page.