---
url: /docs/5.x/reference/diagnostics/kubb-path-traversal.md
description: >-
  The KUBB_PATH_TRAVERSAL diagnostic fires when a resolved output path escapes
  the configured output directory.
---

# KUBB\_PATH\_TRAVERSAL: Path traversal

Code: `KUBB_PATH_TRAVERSAL`
Level: error

A resolved output path escaped the output directory. Kubb refuses to write outside `output.path`, so a crafted spec or a misconfigured `group.name` cannot drop files anywhere on disk.

## What happened

Every generated file resolves to a path under `output.path`. This diagnostic fires when a resolved path lands outside that directory. Kubb treats this as a path-traversal attempt rather than a warning.

The same code guards a second, wider boundary. When a plugin resolver's `file.path` override resolves outside the project `root`, the build stops with `Resolved path "<path>" is outside the project root "<root>".` and the fix `A resolver 'file.path' must return a path inside the project root.`

## How to fix it

* Keep generated paths within the output directory. Review the `group.name` function so it returns a plain name, not a path.
* Treat names coming from the spec as untrusted. Strip or reject `..` and path separators before using them in a file name.

## Common causes

* A `group.name` function that returns `..` segments or an absolute path.
* Operation or tag names from an untrusted spec that contain path separators or `..`.
* A plugin resolver's `file.path` override that resolves outside the project root.

## Example output

```text [Terminal]
[KUBB_PATH_TRAVERSAL]: Resolved path "/tmp/evil.ts" is outside the output directory "/app/src/gen".
  fix: This can stem from a path traversal in the OpenAPI specification or a misconfigured `group.name` function. Keep generated paths within the output directory.
  see: https://kubb.dev/docs/5.x/reference/diagnostics/kubb-path-traversal
```

## See also

* [Configuration](/docs/5.x/reference/configuration)
* [Diagnostics reference](/docs/5.x/reference/diagnostics)