A web application firewall logs repeated requests to an image-download endpoint in which the file parameter steps up four parent directories and names the system password file. One of the requests returned a response of the same size as the server's password file. Which attack is being attempted?

Directory traversal, also called path traversal, exploits an application that builds file system paths from user input without validating or canonicalizing them. Each parent-directory sequence moves one level up the directory tree, so a parameter that steps up repeatedly and then names a system file lets the attacker read content outside the directory the application intended to serve. A response matching the size of the password file suggests at least one attempt succeeded. Command injection inserts operating system commands into input that the application passes to a shell, typically using separators or substitution syntax; the payload here contains only a path, not a command. SQL injection manipulates database queries with quotes, Boolean conditions, and comment markers, and it targets tables rather than files on disk. A buffer overflow supplies input larger than an allocated memory buffer to corrupt adjacent memory; a short path string does not exhibit that characteristic. Exam caveat: encoded variants of the same sequences, such as URL-encoded dots and slashes, still indicate traversal, so analysts should decode payloads before classifying them. Operational check: confirm the endpoint resolves and validates paths against an allow list rooted in the intended directory, run the web service with least privilege, and review access logs for other traversal attempts that returned data.