There's other good posts here about path traversal recently but I don't think anyone has touched on...this (paths matter) has been happening for decades.

Story time. In the early aughts (year 2000 👴 ) Microsoft IIS had a bug due to backwards compatibility with MSDOS 💾 . The effect was you could find an, ummm, open FTP server, create a LPT1 or COM1 directory, then a subdirectory and this path would be invisible to the system admin. If you knew the path, you could ummm store things in it such as the latest movie, game, etc. Arrgh 🏴‍☠️

/edit Ooops, forgot this is a Linux community. Some terms:

IIS - Microsoft's server. It had a bunch of things in one package; web server, file server, email server, etc.

MSDOS - Oldass Microsoft operating system. I forget if its the first one. Only supports 8.3 filenames (8 characters plus 3 for file extension).

FTP - File transfer protocol. We were sending bits over the wire without encryption, YOLO

LPT1/COM1 - special devices in MSDOS, printer port and serial port

I think this is a reference to how giant security products often have very basic security vulnerabilities themselves.

Fortinet firewall path traversal: https://www.sentinelone.com/vulnerability-database/cve-2026-59839/

Cisco firewall path traversal: https://www.sentinelone.com/vulnerability-database/cve-2026-20018/

Big IP firewall path traversal: https://cvefeed.io/vuln/detail/CVE-2025-26427

All discovered in the last year

It's called a Path Traversal attack.

Basically, if you add a ../ in a query, you can start to work backwards in the directory tree to root, then go up again to someplace you shouldn't go. The firewall doesn't block this attack, cause it's just doing a regular HTTP(s) request.

https://owasp.org/www-community/attacks/Path_Traversal

That is a moopsy.

It drinks bones.

The thing cowering and having it's bones drunk is a Pyrithean swamp gobbler. Don't worry about them, they only gobble you.

It's the moopsy you have to watch out for.

Oh, you mean the programming type humor superimposed? No idea.

MOOPSY!!!

That's all you need to know ...