Filesystem Root Exposure

Gixy Check ID: filesystem_root_exposure

The NGINX root and alias directives translate request paths into filesystem paths. Pointing either directive at / makes the operating system's root directory the mapping base:

location / {
    root /;
}

location /files/ {
    alias /;
}

Depending on the surrounding locations and access controls, requests may reach sensitive system files that were never intended to be served. Gixy also detects constant paths that resolve to /, such as /srv/.. and /./. Paths containing variables are not reported because their runtime value cannot be proven statically.

What can I do?

Use a dedicated, narrowly scoped document directory instead:

location / {
    root /var/www/example;
}

location /files/ {
    alias /srv/downloads/;
}

Confirm that the selected directory contains only files intended for public access, and retain explicit access controls for private locations.

Catch this before it reaches production

GetPageSpeed Amplify runs Gixy on a schedule across every NGINX host and alerts you on new findings and CVEs, alongside runtime metrics. Set up continuous monitoring.