domains / families / security / phy-path-traversal-audit

phy-path-traversal-audit

separate

Path traversal and Local File Inclusion (LFI) vulnerability scanner (OWASP A01:2021). Detects user-controlled paths passed to file system sinks in Python/Java/PHP/Node.js/Go/Ruby without containment checks. Identifies missing os.path.abspath+startswith, realpath validation, basename stripping, and PHP include/require with user input. Outputs CWE-22/CWE-23 findings with HTTP taint analysis and per-language safe-path-handling code snippets. Zero competitors on ClawHub.

When to use

• Path traversal vulnerability scanning
• Local File Inclusion (LFI) detection
• OWASP A01:2021 Broken Access Control audit
• CWE-22 and CWE-23 finding identification
• PHP include/require template injection detection
• Safe-path-handling code snippet generation

When not to use

• External API calls
• Non-Python 3 standard library dependencies

Skill page

Source