Skip to main content

16. Bypassing Path Traversal Filters with Unicode Normalization

When a web server or API filters only ../, differences in Unicode normalization (NFC/NFKC) may provide a bypass. For example, if characters such as ..%ef%bc%8f (FULLWIDTH SOLIDUS) or ..%e2%88%95 (DIVISION SLASH) are converted to / after normalization, they pass the filter and break out of the intended file path.

Attack flow summary​

  • Input filter: blocks only the ASCII /
  • Application/library: performs normalization internally
  • Result: ..／ becomes ../, enabling path traversal

Checklist​

  • Check whether normalization happens before or after URL decoding
  • Test mismatches in the proxy's and application's normalization order
  • Inspect the actual path-processing logic of the service behind the WAF

Defensive measures​

  • Validate against an allowlist after normalization
  • Compare joined paths based on realpath
  • Block escape from the root directory rather than merely removing ..

If a CTF input "passes the filter but reads the file," investigate the timing of normalization.