Directory Traversal and Local File Inclusion (LFI) Mitigations

Directory Traversal and Local File Inclusion (LFI) occur when user input is used to dynamically construct file access paths without sanitization.

1. Directory Traversal (`../`)

If a script reads files from a folder based on a URL parameter:

$file = $_GET['page'];
include("templates/" . $file);

An attacker can input `../../../../etc/passwd` to traverse out of the templates folder and print the host user account files directly on the screen.

2. Mitigation: Whitelists

Verify parameters against a static whitelist of allowed files, or extract only the file basename, stripping all directory descriptors (`/` and `\`):

$file = basename($_GET['page']);