picoCTF Solutions
picoCTF 2022Web ExploitationMedium

Forbidden Paths

Published: July 20, 2023Updated: December 9, 2025

Description

The site blocks absolute paths but still reads files relative to the web root. Use directory traversal (`../../../../flag.txt`) to bypass the filter.

Setup

Visit site

Submit filenames through the form.

Absolute paths like `/flag.txt` are rejected, so supply a relative traversal path: `../../../../flag.txt`.

Solution

  1. Step 1Understand the constraint
    The prompt reveals the webroot (`/usr/share/nginx/html`) and that the actual flag is `/flag.txt`.
  2. Step 2Traverse upward
    Entering `../../../../flag.txt` climbs out of the webroot and reads the real flag file.

Flag

picoCTF{7h3_p47h_70_5ucc355_e5fe3d4d}

Classic path traversal-relative paths often slip past simple filtering.