File access with a caller-controlled path
What it finds
A file is read, written, or deleted using a path taken directly from request, tool, or model input, with no visible check that it stays inside an allowed folder.
Why it matters
A path like ../../.env or /etc/passwd lets an attacker read secrets or overwrite files outside the folder the agent is supposed to use.
What an attacker could do: Could expose configuration files and credentials, or let an attacker overwrite or delete files on the host.
How to fix it
Resolve every path against a fixed base directory and reject it unless the resolved path still starts with that directory. Prefer opaque file IDs over raw paths.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- PATH_TRAVERSAL_RISK
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM07 - Insecure Plugin Design, LLM06 - Sensitive Information Disclosure
- NIST AI RMF
- MS-2.3
- SOC 2
- CC6.1, CC6.3
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Unsafe dynamic code executionAV-RUNTIME-005 · Critical
- Privileged or host-mounted container configurationAV-RUNTIME-007 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Prompt injection surface detectedAV-RUNTIME-002 · High