Path Traversal and LFI vulnerabilities let attackers read sensitive files — or escalate to remote code execution — by injecting ../ sequences into file path parameters. This article covers the bypass encodings attackers actually use and the realpath() + prefix check pattern that stops them in Python, PHP, and Node.js.