Filesystem Root Exposure

Gixy Check ID: filesystem_root_exposure

The NGINX root and alias directives translate request paths into filesystem paths. Pointing either directive at / makes the operating system's root directory the mapping base:

location / {
    root /;
}

location /files/ {
    alias /;
}

Depending on the surrounding locations and access controls, requests may reach sensitive system files that were never intended to be served. Gixy also detects constant paths that resolve to /, such as /srv/.. and /./. Paths containing variables are not reported because their runtime value cannot be proven statically.

What can I do?

Use a dedicated, narrowly scoped document directory instead:

location / {
    root /var/www/example;
}

location /files/ {
    alias /srv/downloads/;
}

Confirm that the selected directory contains only files intended for public access, and retain explicit access controls for private locations.

Harden NGINX with maintained RPMs

Use NGINX Extras by GetPageSpeed for continuously updated NGINX and modules on RHEL/CentOS/Alma/Rocky. Learn more.