How path traversal works
Concatenated paths obey ../ the same as your shell does.
File features build paths by concatenation: pages/ plus your ?page= value. Nothing stops the value from containing ../, and the filesystem resolves those segments faithfully — up out of the intended directory, then wherever the attacker points, constrained only by the application's file permissions.
The classic reads are /etc/passwd for OS user enumeration and application config for secrets, but the shape generalizes: any local file the process can read becomes retrievable, and where writes are possible, traversal becomes file overwrite — config, keys, scheduled tasks.
Variants dodge naive filters: absolute paths, ....// collapsing to ../ after one strip pass, URL-encoded and double-encoded separators. The fix ignores all of that: map input to an allowlist of known files, or resolve the full path and verify it stays under the intended root before opening.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.