Preparing access
Checking your lab membership...
Created 30 Aug 2025Updated 30 Aug 2025
Analytics Logs (Path Traversal)
A logs endpoint reads files by name from a logs directory without path sanitization, allowing traversal.
go180 pts20 min
Overview
The Analytics service exposes multiple endpoints that return the contents of log files for debugging:
GET /logs?file=...(infiles/main.go)GET /logs2?file=...(infiles/server.go+files/handlers/logs.go)
An incident revealed arbitrary file reads on the host by abusing .. path traversal.
Your task: identify where traversal occurs and propose a safe join pattern. See files/utils/fs.go for a safe join example (not used by the vulnerable handlers).
Recently created
Jump to the latest lab.
Files
analytics-path-traversal-go
Content locked
Join this lab to access the content.
handlers/logs.gogo