Path traversal in GitHub ?url= param via URL-encoded sequences on Cloud Run

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

This rule identifies web requests containing path traversal sequences (such as '..', '..%2f', or null bytes) or attempts to access sensitive system files (e.g., 'etc/passwd', 'proc/self/environ') within URL query parameters. The rule normalizes different URL query fields and applies regex matching to detect common encoding bypass techniques used to exploit web applications.