Learn in the textbookAttacks on Web Applications
DefinitionDirectory traversal (ディレクトリトラバーサル) is an attack that mixes path notation for going up a level into a requested file name in order to read files on the server that were never made public.
ExplanationA path is notation that shows where a file is by tracing the levels of folders (directories); for example, "../" means one level up. If a program returns contents using a user-supplied file name as is, repeating "../" lets the request escape the public folder. Countermeasures include validating requested file names so they cannot move between levels and tightening access rights to files that are not public.
AnalogyIt is like asking a reference desk not for "the third book on this shelf" but for "back out of this shelf to the corridor, then the first book in the closed stacks", and the clerk hands over the restricted material without checking.
Memory hook"Traversal" comes from "traverse" (to travel across or through). Read as a phrase, "directory traversal" names the trick itself: travelling through the directory levels and out.