Relative Path File Injection: The Next Evolution in RPO

From Relative Path Overwrite to File Injection

While traditional Relative Path Overwrite (RPO) attacks manipulate browser path resolution to inject styles, Relative Path File Injection (RPFI) extends this technique to file downloads. Attackers abuse discrepancies between web specifications and browser URL parsing to trick users into downloading malicious payloads from trusted domains.

Anatomy of an RPFI Attack

The attack vector combines polyglot file constructs with relative path manipulation, allowing benign endpoints to return attacker-controlled executable content. Demonstrations illustrate how innocent-looking links on trusted websites can be weaponized for malware delivery.

Detection and Mitigation Strategies

Identifying RPFI vulnerabilities requires auditing how applications handle dynamic path resolution and strict enforcement of download content types. Open-source proof-of-concept tooling aids in scanning for vulnerable path handling implementations.